hide permanent password change option

common.php

@@ -286,9 +286,15 @@ function qdb_is_web_client_request(): bool {
     return strtolower(trim($h)) === 'web';
 }
 
-/** Reject coach sign-in from the website; coaches use the mobile app only. */
+/** Website or coordinator mobile app — not the counselor field app. */
+function qdb_is_management_client_request(): bool {
+    $h = strtolower(trim($_SERVER['HTTP_X_QDB_CLIENT'] ?? ''));
+    return in_array($h, ['web', 'coordinator'], true);
+}
+
+/** Reject coach sign-in from management clients; coaches use the field app only. */
 function qdb_reject_coach_web_login(string $role): void {
-    if ($role === 'coach' && qdb_is_web_client_request()) {
+    if ($role === 'coach' && qdb_is_management_client_request()) {
         json_error(
             'FORBIDDEN',
             'Counselor accounts can only sign in through the mobile app.',