Everything the affiliate dashboard paints, for one period (spec 3.8).

<br/>Open to EVERY affiliate status: a pending applicant reads the same<br/>payload with every number at zero plus the checklist that tells them what<br/>happens next, which is what makes the dashboard available from day one.<br/>Only a user with NO affiliate row at all is refused, with 404<br/>not_an_affiliate, the same code /referrals and /profile answer for<br/>the same condition. (Spec 2 wrote it not_affiliate; one module speaking<br/>one word about one fact beats matching the prose.)<br/><br/>range is one of today, 24h, 7d, 30d, ytd, 365d, defaulting<br/>to 30d when it is absent. ONE period covers the whole page, so the<br/>tiles, the chart, the funnel, the activity feed and the two card<br/>previews are all counted over it; the balances, the next payout and the<br/>checklist are all time and say so on the page. An unrecognised word is<br/>422 invalid_range in this module's error shape rather than a silent<br/>fall back to the default: a client asking for a window we do not have<br/>should be told, not quietly answered about a different one.<br/><br/>The response is cached for a minute, privately. The numbers move on<br/>webhook time, not on request time, so a dashboard that re-renders four<br/>cards in a second should not run these aggregates four times; private<br/>keeps one affiliate's figures out of any shared cache between us and them.<br/><br/>Serialized with mode="json", so every date and datetime ships as ISO<br/>8601 ("2026-09-11", "2026-09-11T12:00:00Z"). Flask's default provider<br/>renders a bare date as an HTTP-date ("Fri, 11 Sep 2026 00:00:00 GMT"),<br/>which is unusable as the key of a chart bucket. This matches what most of<br/>the app's routes already do; the older affiliate routes do not, which is<br/>a wart to clean up separately rather than in the middle of this one.