Codebase hardening: 102 fixes across 35+ files

Deep audit identified 106 findings; 102 fixed, 4 deferred. Covers 8 areas:

- Settings & deploy: env-gated DEBUG/SECRET_KEY, HTTPS headers, gunicorn, celery worker
- Auth (registered_user): password write_only, request.data fixes, transaction safety, proper HTTP status codes
- Workout app: IDOR protection, get_object_or_404, prefetch_related N+1 fixes, transaction.atomic
- Video/scripts: path traversal sanitization, HLS trigger guard, auth on cache wipe
- Models (exercise/equipment/muscle/superset): null-safe __str__, stable IDs, prefetch support
- Generator views: helper for registered_user lookup, logger.exception, bulk_update, transaction wrapping
- Generator core (rules/selector/generator): push-pull ratio, type affinity normalization, modality checks, side-pair exact match, word-boundary regex, equipment cache clearing
- Generator services (plan_builder/analyzer/normalizer): transaction.atomic, muscle cache, bulk_update, glutes classification fix

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

generator/services/workout_generation/scaling.py

@@ -0,0 +1,31 @@
+def apply_fitness_scaling(
+    params: dict,
+    *,
+    fitness_level: int,
+    scaling_config: dict,
+    min_reps: int,
+    min_reps_strength: int,
+    is_strength: bool = False,
+) -> dict:
+    """Scale workout params based on fitness level."""
+    out = dict(params)
+    level = fitness_level or 2
+    scaling = scaling_config.get(level, scaling_config[2])
+    rep_floor = min_reps_strength if is_strength else min_reps
+
+    out['rep_min'] = max(rep_floor, int(out['rep_min'] * scaling['rep_min_mult']))
+    out['rep_max'] = max(out['rep_min'], int(out['rep_max'] * scaling['rep_max_mult']))
+
+    rounds_min, rounds_max = out['rounds']
+    rounds_min = max(1, rounds_min + scaling['rounds_adj'])
+    rounds_max = max(rounds_min, rounds_max + scaling['rounds_adj'])
+    out['rounds'] = (rounds_min, rounds_max)
+
+    rest = out.get('rest_between_rounds', 45)
+    out['rest_between_rounds'] = max(15, rest + scaling['rest_adj'])
+
+    if level <= 1 and is_strength:
+        out['rep_min'] = max(5, out['rep_min'])
+        out['rep_max'] = max(out['rep_min'], out['rep_max'])
+    return out
+