Codebase hardening: 102 fixes across 35+ files

Deep audit identified 106 findings; 102 fixed, 4 deferred. Covers 8 areas:

- Settings & deploy: env-gated DEBUG/SECRET_KEY, HTTPS headers, gunicorn, celery worker
- Auth (registered_user): password write_only, request.data fixes, transaction safety, proper HTTP status codes
- Workout app: IDOR protection, get_object_or_404, prefetch_related N+1 fixes, transaction.atomic
- Video/scripts: path traversal sanitization, HLS trigger guard, auth on cache wipe
- Models (exercise/equipment/muscle/superset): null-safe __str__, stable IDs, prefetch support
- Generator views: helper for registered_user lookup, logger.exception, bulk_update, transaction wrapping
- Generator core (rules/selector/generator): push-pull ratio, type affinity normalization, modality checks, side-pair exact match, word-boundary regex, equipment cache clearing
- Generator services (plan_builder/analyzer/normalizer): transaction.atomic, muscle cache, bulk_update, glutes classification fix

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

generator/services/muscle_normalizer.py

@@ -157,7 +157,7 @@ MUSCLE_GROUP_CATEGORIES: dict[str, list[str]] = {
         'traps', 'forearms', 'rotator cuff',
     ],
     'lower_push': [
-        'quads', 'calves', 'glutes', 'hip abductors', 'hip adductors',
+        'quads', 'calves', 'hip abductors', 'hip adductors',
     ],
     'lower_pull': [
         'hamstrings', 'glutes', 'lower back', 'hip flexors',
@@ -202,6 +202,9 @@ def normalize_muscle_name(name: Optional[str]) -> Optional[str]:
     return key
 
 
+_muscle_cache: dict[int, Set[str]] = {}
+
+
 def get_muscles_for_exercise(exercise) -> Set[str]:
     """
     Return the set of normalized muscle names for a given Exercise instance.
@@ -209,7 +212,12 @@ def get_muscles_for_exercise(exercise) -> Set[str]:
     Uses the ExerciseMuscle join table (exercise.exercise_muscle_exercise).
     Falls back to the comma-separated Exercise.muscle_groups field if no
     ExerciseMuscle rows exist.
+
+    Results are cached per exercise ID to avoid repeated DB queries.
     """
+    if exercise.id in _muscle_cache:
+        return _muscle_cache[exercise.id]
+
     from muscle.models import ExerciseMuscle
 
     muscles: Set[str] = set()
@@ -229,9 +237,15 @@ def get_muscles_for_exercise(exercise) -> Set[str]:
             if normalized:
                 muscles.add(normalized)
 
+    _muscle_cache[exercise.id] = muscles
     return muscles
 
 
+def clear_muscle_cache() -> None:
+    """Clear the muscle cache (useful for testing or re-analysis)."""
+    _muscle_cache.clear()
+
+
 def get_movement_patterns_for_exercise(exercise) -> List[str]:
     """
     Parse the comma-separated movement_patterns CharField on Exercise and