Codebase hardening: 102 fixes across 35+ files

Deep audit identified 106 findings; 102 fixed, 4 deferred. Covers 8 areas:

- Settings & deploy: env-gated DEBUG/SECRET_KEY, HTTPS headers, gunicorn, celery worker
- Auth (registered_user): password write_only, request.data fixes, transaction safety, proper HTTP status codes
- Workout app: IDOR protection, get_object_or_404, prefetch_related N+1 fixes, transaction.atomic
- Video/scripts: path traversal sanitization, HLS trigger guard, auth on cache wipe
- Models (exercise/equipment/muscle/superset): null-safe __str__, stable IDs, prefetch support
- Generator views: helper for registered_user lookup, logger.exception, bulk_update, transaction wrapping
- Generator core (rules/selector/generator): push-pull ratio, type affinity normalization, modality checks, side-pair exact match, word-boundary regex, equipment cache clearing
- Generator services (plan_builder/analyzer/normalizer): transaction.atomic, muscle cache, bulk_update, glutes classification fix

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

generator/services/workout_generation/modality.py

@@ -0,0 +1,53 @@
+import math
+import random
+from typing import Optional
+
+
+def clamp_duration_bias(duration_bias: float, duration_bias_range: Optional[tuple]) -> float:
+    """Clamp duration bias to [0,1] or workout-type specific range."""
+    if not duration_bias_range:
+        return max(0.0, min(1.0, duration_bias))
+    low, high = duration_bias_range
+    return max(float(low), min(float(high), duration_bias))
+
+
+def plan_superset_modalities(
+    *,
+    num_supersets: int,
+    duration_bias: float,
+    duration_bias_range: Optional[tuple],
+    is_strength_workout: bool,
+    rng=random,
+) -> list[bool]:
+    """Plan per-superset modality (True=duration, False=reps)."""
+    if num_supersets <= 0:
+        return []
+    if is_strength_workout:
+        return [False] * num_supersets
+
+    if duration_bias_range:
+        low, high = duration_bias_range
+        target_bias = (float(low) + float(high)) / 2.0
+        min_duration_sets = max(0, math.ceil(num_supersets * float(low)))
+        max_duration_sets = min(num_supersets, math.floor(num_supersets * float(high)))
+    else:
+        target_bias = max(0.0, min(1.0, duration_bias))
+        min_duration_sets = max(0, math.floor(num_supersets * max(0.0, target_bias - 0.15)))
+        max_duration_sets = min(num_supersets, math.ceil(num_supersets * min(1.0, target_bias + 0.15)))
+
+    duration_sets = int(round(num_supersets * target_bias))
+    duration_sets = max(min_duration_sets, min(max_duration_sets, duration_sets))
+
+    if num_supersets > 1 and duration_sets == num_supersets and max_duration_sets < num_supersets:
+        duration_sets = max_duration_sets
+    if num_supersets > 1 and duration_sets == 0 and min_duration_sets > 0:
+        duration_sets = min_duration_sets
+
+    modalities = [False] * num_supersets
+    if duration_sets > 0:
+        positions = list(range(num_supersets))
+        rng.shuffle(positions)
+        for idx in positions[:duration_sets]:
+            modalities[idx] = True
+    return modalities
+