Open app/templates/dashboard.html and:

1) In the Overview filter bar (above the chart), add an Advisor dropdown:

<div>
  <label class="block text-[11px] text-zinc-400 mb-1">Advisor</label>
  <select id="advisor" class="bg-zinc-950 border border-zinc-700 rounded px-2 py-1 text-xs">
    <option value="">All</option>
  </select>
</div>

2) In the <script> block:

- Add a function to populate advisors:

async function loadAdvisors() {
  const sel = document.getElementById("advisor");
  if (!sel) return;
  try {
    const res = await fetch("/api/advisors", { headers: { "X-API-Key": (window.API_KEY || "") }});
    const payload = await res.json();
    (payload.data || []).forEach(a => {
      const opt = document.createElement("option");
      opt.value = a;
      opt.textContent = a;
      sel.appendChild(opt);
    });
  } catch (e) { console.warn("Advisors load failed", e); }
}

- In loadTrendChart() append advisor to query if selected:

const advEl = document.getElementById("advisor");
if (advEl?.value) params.set("advisor", advEl.value);

- In loadRetentionPen() pass advisor too:

const advEl2 = document.getElementById("advisor");
if (advEl2?.value) params.set("advisor", advEl2.value);

- In DOMContentLoaded handler, call loadAdvisors() before loadTrendChart()/loadRetentionPen():

loadAdvisors().then(() => {
  loadTrendChart();
  loadRetentionPen();
});

- Also, re-apply filters when Advisor changes:

const advSel = document.getElementById("advisor");
if (advSel) {
  advSel.addEventListener("change", () => {
    // redraw chart
    const canvas = document.getElementById("trend-chart");
    if (canvas) {
      const parent = canvas.parentElement;
      canvas.remove();
      const fresh = document.createElement("canvas");
      fresh.id = "trend-chart";
      fresh.className = "w-full h-48";
      parent.appendChild(fresh);
    }
    loadTrendChart();
    loadRetentionPen();
  });
}

3) Ensure fetch requests include X-API-Key header. You can inject via fetch options; for same-origin browser calls it’s optional, but add this line where you build fetch() calls if API_KEY is set server-side:

headers: { "X-API-Key": (window.API_KEY || "") }

(If you’re not injecting a window.API_KEY, skip this; same-origin requests will pass because the server check only enforces when API_KEY is set and header mismatches. You can tighten later.)