Codebase hardening: 102 fixes across 35+ files

Deep audit identified 106 findings; 102 fixed, 4 deferred. Covers 8 areas:

- Settings & deploy: env-gated DEBUG/SECRET_KEY, HTTPS headers, gunicorn, celery worker
- Auth (registered_user): password write_only, request.data fixes, transaction safety, proper HTTP status codes
- Workout app: IDOR protection, get_object_or_404, prefetch_related N+1 fixes, transaction.atomic
- Video/scripts: path traversal sanitization, HLS trigger guard, auth on cache wipe
- Models (exercise/equipment/muscle/superset): null-safe __str__, stable IDs, prefetch support
- Generator views: helper for registered_user lookup, logger.exception, bulk_update, transaction wrapping
- Generator core (rules/selector/generator): push-pull ratio, type affinity normalization, modality checks, side-pair exact match, word-boundary regex, equipment cache clearing
- Generator services (plan_builder/analyzer/normalizer): transaction.atomic, muscle cache, bulk_update, glutes classification fix

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

video/models.py

@@ -17,14 +17,26 @@ class Video(models.Model):
     gender = models.PositiveSmallIntegerField(
       choices=VIDEO_GENDER
     )
-    
+
     def __str__(self):
         return  str(self.video_file)
 
-    def save(self, **kwargs):
-        super(Video, self).save(**kwargs)
-        filename = self.video_file.name
-        create_hls_tasks.delay(filename)
+    def save(self, *args, **kwargs):
+        is_new = self.pk is None
+        if self.pk:
+            try:
+                old = type(self).objects.get(pk=self.pk)
+                video_changed = old.video_file != self.video_file
+            except type(self).DoesNotExist:
+                video_changed = True
+        else:
+            video_changed = bool(self.video_file)
+
+        super(Video, self).save(*args, **kwargs)
+
+        if self.video_file and (is_new or video_changed):
+            filename = self.video_file.name
+            create_hls_tasks.delay(filename)
 
     
     
@@ -33,10 +45,22 @@ class ExerciseVideo(models.Model):
     updated_at = models.DateTimeField(auto_now=True)
     video_file = models.FileField(upload_to='videos/', null=True, verbose_name="")
 
-    def save(self, **kwargs):
-        super(ExerciseVideo, self).save(**kwargs)
-        filename = self.video_file.name
-        create_hls_tasks.delay(filename)
+    def save(self, *args, **kwargs):
+        is_new = self.pk is None
+        if self.pk:
+            try:
+                old = type(self).objects.get(pk=self.pk)
+                video_changed = old.video_file != self.video_file
+            except type(self).DoesNotExist:
+                video_changed = True
+        else:
+            video_changed = bool(self.video_file)
+
+        super(ExerciseVideo, self).save(*args, **kwargs)
+
+        if self.video_file and (is_new or video_changed):
+            filename = self.video_file.name
+            create_hls_tasks.delay(filename)
 
 @receiver(pre_delete, sender=ExerciseVideo)
 def delete_exercise_video(sender, instance, using, **kwargs):