feat: add Phase 3 Workout UI — auth, profiles, workout viewer, exercise browser

Build the core user-facing experience with admin login (bcrypt + signed
session cookies), profile switcher, workout day viewer with warmups and
exercise cards, and HTMX-powered exercise browser with search/filter.

- AuthService with bcrypt password verification and itsdangerous session tokens
- Auth dependency redirects to /login (303) for unauthenticated requests
- NavContextMiddleware injects admin/profiles/active_profile into all templates
- Profile management (list, switch, edit) with cookie-based active profile
- Workout day viewer shows warmups + exercises + per-user programming targets
- Exercise browser with HTMX filter dropdowns (no page reloads)
- Flash message partial for success/error feedback
- 12 new tests (66 total passing)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/routes/workouts.py

@@ -0,0 +1,98 @@
+"""Workout day viewer routes.
+
+Displays the warmup routine and main exercises for each workout day,
+with the active profile's programming targets.
+"""
+
+import structlog
+from fastapi import APIRouter, Depends, Request
+from fastapi.responses import HTMLResponse
+from sqlmodel import Session, select
+
+from app.database import get_db_session
+from app.models.user import User
+from app.models.user_exercise_program import UserExerciseProgram
+from app.services.exercise_service import ExerciseService
+from app.utils.auth import get_current_admin_user, get_active_profile_id
+
+logger = structlog.get_logger(__name__)
+
+router = APIRouter(prefix="/workouts", tags=["workouts"])
+
+
+@router.get("", response_class=HTMLResponse)
+async def workout_days_list(
+    request: Request,
+    session: Session = Depends(get_db_session),
+    admin: User = Depends(get_current_admin_user),
+):
+    """List all workout days as clickable cards.
+
+    Args:
+        request: The incoming HTTP request.
+        session: Database session.
+        admin: The authenticated admin user.
+
+    Returns:
+        Rendered workout days list page.
+    """
+    exercise_service = ExerciseService(session)
+    days = exercise_service.list_workout_days()
+
+    templates = request.app.state.templates
+    return templates.TemplateResponse("pages/workout_days.html", {
+        "request": request,
+        "days": days,
+        "admin": admin,
+    })
+
+
+@router.get("/{day_name}", response_class=HTMLResponse)
+async def workout_day_detail(
+    day_name: str,
+    request: Request,
+    session: Session = Depends(get_db_session),
+    admin: User = Depends(get_current_admin_user),
+):
+    """Display a full workout day -- warmups + exercises with form cues.
+
+    Args:
+        day_name: The workout day name (e.g., "push", "pull").
+        request: The incoming HTTP request.
+        session: Database session.
+        admin: The authenticated admin user.
+
+    Returns:
+        Rendered workout day detail page.
+    """
+    exercise_service = ExerciseService(session)
+
+    # Normalize day name for DB lookup (e.g., "push" -> "Push", "full-body" -> "Full Body")
+    day_display = day_name.replace("-", " ").title()
+
+    warmups = exercise_service.list_warmups()
+    exercises = exercise_service.list_exercises(workout_day=day_display)
+
+    # Get active profile's programming if set
+    active_profile_id = get_active_profile_id(request)
+    programs = {}
+    active_profile = None
+    if active_profile_id:
+        active_profile = session.get(User, active_profile_id)
+        if active_profile:
+            statement = select(UserExerciseProgram).where(
+                UserExerciseProgram.user_id == active_profile_id
+            )
+            for prog in session.exec(statement).all():
+                programs[prog.exercise_id] = prog
+
+    templates = request.app.state.templates
+    return templates.TemplateResponse("pages/workout_day.html", {
+        "request": request,
+        "day_name": day_display,
+        "warmups": warmups,
+        "exercises": exercises,
+        "programs": programs,
+        "active_profile": active_profile,
+        "admin": admin,
+    })