Codebase hardening: 102 fixes across 35+ files

Deep audit identified 106 findings; 102 fixed, 4 deferred. Covers 8 areas:

- Settings & deploy: env-gated DEBUG/SECRET_KEY, HTTPS headers, gunicorn, celery worker
- Auth (registered_user): password write_only, request.data fixes, transaction safety, proper HTTP status codes
- Workout app: IDOR protection, get_object_or_404, prefetch_related N+1 fixes, transaction.atomic
- Video/scripts: path traversal sanitization, HLS trigger guard, auth on cache wipe
- Models (exercise/equipment/muscle/superset): null-safe __str__, stable IDs, prefetch support
- Generator views: helper for registered_user lookup, logger.exception, bulk_update, transaction wrapping
- Generator core (rules/selector/generator): push-pull ratio, type affinity normalization, modality checks, side-pair exact match, word-boundary regex, equipment cache clearing
- Generator services (plan_builder/analyzer/normalizer): transaction.atomic, muscle cache, bulk_update, glutes classification fix

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

exercise/serializers.py

@@ -2,7 +2,6 @@ from rest_framework import serializers
 from .models import *
 from muscle.models import ExerciseMuscle
 from equipment.models import WorkoutEquipment
-from muscle.serializers import ExerciseMuscleSerializer
 from equipment.serializers import WorkoutEquipmentSerializer
 
 class ExerciseMuscleSerializer(serializers.ModelSerializer):
@@ -11,7 +10,7 @@ class ExerciseMuscleSerializer(serializers.ModelSerializer):
     class Meta:
         model = ExerciseMuscle
         fields = '__all__'
-    
+
     def get_name(self, obj):
         return obj.muscle.name
 
@@ -26,12 +25,14 @@ class ExerciseSerializer(serializers.ModelSerializer):
         model = Exercise
         fields = '__all__'
 
-    def get_muscles(self, obj): 
-        objs = ExerciseMuscle.objects.filter(exercise=obj)
-        data = ExerciseMuscleSerializer(objs, many=True).data
-        return data
-    
-    def get_equipment(self, obj): 
-        objs = WorkoutEquipment.objects.filter(exercise=obj)
-        data = WorkoutEquipmentSerializer(objs, many=True).data
-        return data
+    def get_muscles(self, obj):
+        # Use prefetched data if available, avoiding N+1 queries
+        if hasattr(obj, '_prefetched_objects_cache') and 'exercise_muscle_exercise' in obj._prefetched_objects_cache:
+            return [{'muscle': em.muscle_id, 'name': em.muscle.name} for em in obj.exercise_muscle_exercise.all()]
+        return list(obj.exercise_muscle_exercise.values('muscle', name=models.F('muscle__name')))
+
+    def get_equipment(self, obj):
+        # Use prefetched data if available, avoiding N+1 queries
+        if hasattr(obj, '_prefetched_objects_cache') and 'workout_exercise_workout' in obj._prefetched_objects_cache:
+            return [{'equipment': we.equipment_id, 'name': we.equipment.name} for we in obj.workout_exercise_workout.all()]
+        return list(obj.workout_exercise_workout.values('equipment', name=models.F('equipment__name')))