docs: cross-reference leaderboard duplication, service-role-key warning

- Add cross-reference comments between dashboard-queries.ts computeLeaderboard()
  and dashboard/ui.ts renderLeaderboard() so maintainers know to update both
- Add security note in setup-team-dashboard about service-role-key visibility
  in pg_cron job table

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/dashboard-queries.ts

@@ -228,6 +228,9 @@ export function computeCostTrend(evalRuns: Record<string, unknown>[]): CostTrend
   return { weekly, totalAllTime };
 }
 
+// NOTE: The dashboard UI (supabase/functions/dashboard/ui.ts renderLeaderboard())
+// has a parallel client-side implementation of this logic. If you change the
+// aggregation or sorting here, update the dashboard JS too.
 /**
  * Compute team leaderboard for the current week.
  */

setup-team-dashboard/SKILL.md

@@ -83,6 +83,8 @@ select cron.schedule(
 
 Replace `<supabase-url>` and `<service-role-key>` with actual values.
 
+**Security note:** The service-role-key is stored in the `cron.job` table and visible to anyone with SQL editor access to your Supabase project. This is the standard Supabase pattern for cron → edge function calls. If this concerns you, use Supabase Vault to store the key instead.
+
 ### Step 7: Configure Slack webhook
 
 Ask the user for their Slack webhook URL (from https://api.slack.com/messaging/webhooks).

supabase/functions/dashboard/ui.ts

@@ -768,6 +768,8 @@ export function getDashboardHTML(supabaseUrl: string, anonKey: string): string {
   }
 
   // ---- Leaderboard ----
+  // NOTE: This leaderboard aggregation mirrors lib/dashboard-queries.ts computeLeaderboard().
+  // If you change the logic here, update the shared pure function too (used by CLI).
   function renderLeaderboard() {
     const ws = weekStart();
     const hasAnyData = data.evalRuns || data.shipLogs || data.transcripts;