Codebase hardening: 102 fixes across 35+ files

Deep audit identified 106 findings; 102 fixed, 4 deferred. Covers 8 areas:

- Settings & deploy: env-gated DEBUG/SECRET_KEY, HTTPS headers, gunicorn, celery worker
- Auth (registered_user): password write_only, request.data fixes, transaction safety, proper HTTP status codes
- Workout app: IDOR protection, get_object_or_404, prefetch_related N+1 fixes, transaction.atomic
- Video/scripts: path traversal sanitization, HLS trigger guard, auth on cache wipe
- Models (exercise/equipment/muscle/superset): null-safe __str__, stable IDs, prefetch support
- Generator views: helper for registered_user lookup, logger.exception, bulk_update, transaction wrapping
- Generator core (rules/selector/generator): push-pull ratio, type affinity normalization, modality checks, side-pair exact match, word-boundary regex, equipment cache clearing
- Generator services (plan_builder/analyzer/normalizer): transaction.atomic, muscle cache, bulk_update, glutes classification fix

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

video/tasks.py

@@ -7,7 +7,8 @@ from django.core.files.storage import default_storage
 
 @shared_task()
 def create_hls_tasks(filename):
-    end_location = str(settings.MEDIA_ROOT) + "/" + str(filename) +'.m3u8'
+    base_name = os.path.splitext(str(filename))[0]
+    end_location = str(settings.MEDIA_ROOT) + "/" + base_name + '.m3u8'
     if not default_storage.exists(end_location):
         media_location = str(settings.MEDIA_ROOT) + "/" + str(filename)
         video = ffmpeg_streaming.input(media_location)
@@ -21,6 +22,6 @@ def create_hls_tasks(filename):
         #     first_video.get('height', "Unknown")
         # )
         # print(f"Dimensions: {dimensions[0]}x{dimensions[1]}")  # f-string
-        
+
         hls.auto_generate_representations()
-        hls.output(end_location)
+        hls.output(end_location)