Codebase hardening: 102 fixes across 35+ files

Deep audit identified 106 findings; 102 fixed, 4 deferred. Covers 8 areas:

- Settings & deploy: env-gated DEBUG/SECRET_KEY, HTTPS headers, gunicorn, celery worker
- Auth (registered_user): password write_only, request.data fixes, transaction safety, proper HTTP status codes
- Workout app: IDOR protection, get_object_or_404, prefetch_related N+1 fixes, transaction.atomic
- Video/scripts: path traversal sanitization, HLS trigger guard, auth on cache wipe
- Models (exercise/equipment/muscle/superset): null-safe __str__, stable IDs, prefetch support
- Generator views: helper for registered_user lookup, logger.exception, bulk_update, transaction wrapping
- Generator core (rules/selector/generator): push-pull ratio, type affinity normalization, modality checks, side-pair exact match, word-boundary regex, equipment cache clearing
- Generator services (plan_builder/analyzer/normalizer): transaction.atomic, muscle cache, bulk_update, glutes classification fix

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

generator/services/workout_generation/focus.py

@@ -0,0 +1,41 @@
+from typing import Optional
+
+from generator.services.exercise_selector import extract_movement_families
+
+
+def focus_key_for_exercise(exercise) -> Optional[str]:
+    """Classify exercise into a coarse focus key used for variety checks."""
+    if exercise is None:
+        return None
+    families = sorted(extract_movement_families(getattr(exercise, 'name', '') or ''))
+    if families:
+        return families[0]
+    patterns = (getattr(exercise, 'movement_patterns', '') or '').lower()
+    for token in ('upper pull', 'upper push', 'hip hinge', 'squat', 'lunge', 'core', 'carry'):
+        if token in patterns:
+            return token
+    return None
+
+
+def has_duplicate_focus(exercises: list) -> bool:
+    """True when two exercises in one superset map to the same focus key."""
+    seen = set()
+    for ex in exercises or []:
+        key = focus_key_for_exercise(ex)
+        if not key:
+            continue
+        if key in seen:
+            return True
+        seen.add(key)
+    return False
+
+
+def focus_keys_for_exercises(exercises: list) -> set:
+    """Return non-empty focus keys for a list of exercises."""
+    keys = set()
+    for ex in exercises or []:
+        key = focus_key_for_exercise(ex)
+        if key:
+            keys.add(key)
+    return keys
+