Codebase hardening: 102 fixes across 35+ files

Deep audit identified 106 findings; 102 fixed, 4 deferred. Covers 8 areas:

- Settings & deploy: env-gated DEBUG/SECRET_KEY, HTTPS headers, gunicorn, celery worker
- Auth (registered_user): password write_only, request.data fixes, transaction safety, proper HTTP status codes
- Workout app: IDOR protection, get_object_or_404, prefetch_related N+1 fixes, transaction.atomic
- Video/scripts: path traversal sanitization, HLS trigger guard, auth on cache wipe
- Models (exercise/equipment/muscle/superset): null-safe __str__, stable IDs, prefetch support
- Generator views: helper for registered_user lookup, logger.exception, bulk_update, transaction wrapping
- Generator core (rules/selector/generator): push-pull ratio, type affinity normalization, modality checks, side-pair exact match, word-boundary regex, equipment cache clearing
- Generator services (plan_builder/analyzer/normalizer): transaction.atomic, muscle cache, bulk_update, glutes classification fix

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

generator/services/workout_generation/pattern_planning.py

@@ -0,0 +1,26 @@
+def working_position_label(ss_idx: int, num_supersets: int) -> str:
+    """Return early/middle/late position label for a working superset index."""
+    if num_supersets <= 1 or ss_idx == 0:
+        return 'early'
+    if ss_idx >= num_supersets - 1:
+        return 'late'
+    return 'middle'
+
+
+def merge_pattern_preferences(position_patterns, rule_patterns):
+    """Combine positional and structure-rule pattern preferences."""
+    if rule_patterns and position_patterns:
+        overlap = [p for p in position_patterns if p in rule_patterns]
+        return overlap or rule_patterns[:3]
+    if rule_patterns:
+        return rule_patterns[:3]
+    return position_patterns
+
+
+def rotated_muscle_subset(target_muscles: list[str], ss_idx: int) -> list[str]:
+    """Rotate target muscle emphasis between supersets."""
+    if len(target_muscles) <= 1:
+        return target_muscles
+    start = ss_idx % len(target_muscles)
+    return target_muscles[start:] + target_muscles[:start]
+