Codebase hardening: 102 fixes across 35+ files

Deep audit identified 106 findings; 102 fixed, 4 deferred. Covers 8 areas:

- Settings & deploy: env-gated DEBUG/SECRET_KEY, HTTPS headers, gunicorn, celery worker
- Auth (registered_user): password write_only, request.data fixes, transaction safety, proper HTTP status codes
- Workout app: IDOR protection, get_object_or_404, prefetch_related N+1 fixes, transaction.atomic
- Video/scripts: path traversal sanitization, HLS trigger guard, auth on cache wipe
- Models (exercise/equipment/muscle/superset): null-safe __str__, stable IDs, prefetch support
- Generator views: helper for registered_user lookup, logger.exception, bulk_update, transaction wrapping
- Generator core (rules/selector/generator): push-pull ratio, type affinity normalization, modality checks, side-pair exact match, word-boundary regex, equipment cache clearing
- Generator services (plan_builder/analyzer/normalizer): transaction.atomic, muscle cache, bulk_update, glutes classification fix

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

generator/tests/test_rebalance_replacement_guard.py

@@ -0,0 +1,60 @@
+from django.contrib.auth.models import User
+from django.test import TestCase
+
+from exercise.models import Exercise
+from generator.models import UserPreference
+from generator.services.workout_generator import WorkoutGenerator
+from registered_user.models import RegisteredUser
+
+
+class TestRebalanceReplacementGuard(TestCase):
+    def setUp(self):
+        django_user = User.objects.create_user(
+            username='rebalance_guard_user',
+            password='testpass123',
+        )
+        registered_user = RegisteredUser.objects.create(
+            user=django_user,
+            first_name='Rebalance',
+            last_name='Guard',
+        )
+        self.preference = UserPreference.objects.create(
+            registered_user=registered_user,
+            days_per_week=4,
+            fitness_level=2,
+        )
+
+    def test_pull_replacement_prefers_non_sided_candidates(self):
+        sided_pull = Exercise.objects.create(
+            name='Single Arm Cable Row',
+            side='left_arm',
+            movement_patterns='upper pull - horizontal, upper pull',
+            muscle_groups='lats,upper back,biceps',
+            is_reps=True,
+            is_duration=False,
+            is_weight=True,
+            is_compound=False,
+            difficulty_level='intermediate',
+        )
+        unsided_pull = Exercise.objects.create(
+            name='Chest Supported Row',
+            side='',
+            movement_patterns='upper pull - horizontal, upper pull',
+            muscle_groups='lats,upper back,biceps',
+            is_reps=True,
+            is_duration=False,
+            is_weight=True,
+            is_compound=False,
+            difficulty_level='intermediate',
+        )
+
+        generator = WorkoutGenerator(self.preference)
+        replacement = generator._select_pull_replacement(
+            target_muscles=[],
+            is_duration_based=False,
+            prefer_weighted=False,
+        )
+
+        self.assertIsNotNone(replacement)
+        self.assertEqual(replacement.pk, unsided_pull.pk)
+        self.assertNotEqual(replacement.pk, sided_pull.pk)