feat: add Phase 3 Workout UI — auth, profiles, workout viewer, exercise browser

Build the core user-facing experience with admin login (bcrypt + signed
session cookies), profile switcher, workout day viewer with warmups and
exercise cards, and HTMX-powered exercise browser with search/filter.

- AuthService with bcrypt password verification and itsdangerous session tokens
- Auth dependency redirects to /login (303) for unauthenticated requests
- NavContextMiddleware injects admin/profiles/active_profile into all templates
- Profile management (list, switch, edit) with cookie-based active profile
- Workout day viewer shows warmups + exercises + per-user programming targets
- Exercise browser with HTMX filter dropdowns (no page reloads)
- Flash message partial for success/error feedback
- 12 new tests (66 total passing)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/templates/pages/exercise_browser.html

@@ -0,0 +1,38 @@
+{% extends "base.html" %}
+
+{% block title %}Exercise Library — SneakySwole{% endblock %}
+
+{% block content %}
+<hgroup>
+    <h1>Exercise Library</h1>
+    <p>Browse all exercises with form cues and programming details.</p>
+</hgroup>
+
+<!-- HTMX-powered filters -->
+<div class="grid">
+    <select name="workout_day"
+            hx-get="/exercises/search"
+            hx-target="#exercise-results"
+            hx-include="[name='muscle_group']">
+        <option value="">All Days</option>
+        {% for day in workout_days %}
+        <option value="{{ day.name }}">{{ day.name }}</option>
+        {% endfor %}
+    </select>
+
+    <select name="muscle_group"
+            hx-get="/exercises/search"
+            hx-target="#exercise-results"
+            hx-include="[name='workout_day']">
+        <option value="">All Muscle Groups</option>
+        {% for mg in muscle_groups %}
+        <option value="{{ mg }}">{{ mg }}</option>
+        {% endfor %}
+    </select>
+</div>
+
+<!-- Exercise results (replaced by HTMX on filter change) -->
+<div id="exercise-results">
+    {% include "partials/exercise_list.html" %}
+</div>
+{% endblock %}

app/templates/pages/login.html

@@ -0,0 +1,27 @@
+{% extends "base.html" %}
+
+{% block title %}SneakySwole — Login{% endblock %}
+
+{% block content %}
+<article>
+    <header>
+        <h2>Admin Login</h2>
+    </header>
+
+    {% if error %}
+    <div class="flash-error" role="alert">{{ error }}</div>
+    {% endif %}
+
+    <form method="POST" action="/login">
+        <label for="username">Username</label>
+        <input type="text" id="username" name="username"
+               placeholder="Enter username" required autofocus>
+
+        <label for="password">Password</label>
+        <input type="password" id="password" name="password"
+               placeholder="Enter password" required>
+
+        <button type="submit">Login</button>
+    </form>
+</article>
+{% endblock %}

app/templates/pages/profile_edit.html

@@ -0,0 +1,34 @@
+{% extends "base.html" %}
+
+{% block title %}Edit Profile — {{ profile.display_name }}{% endblock %}
+
+{% block content %}
+<article>
+    <header>
+        <h2>Edit Profile: {{ profile.display_name }}</h2>
+    </header>
+
+    <form method="POST" action="/profiles/{{ profile.id }}/edit">
+        <label for="display_name">Display Name</label>
+        <input type="text" id="display_name" name="display_name"
+               value="{{ profile.display_name }}" required>
+
+        <label for="height">Height</label>
+        <input type="text" id="height" name="height"
+               value="{{ profile.height or '' }}" placeholder="e.g., 6'0&quot;">
+
+        <label for="weight">Weight</label>
+        <input type="text" id="weight" name="weight"
+               value="{{ profile.weight or '' }}" placeholder="e.g., 260 lbs">
+
+        <label for="goals">Goals</label>
+        <textarea id="goals" name="goals"
+                  placeholder="Training goals...">{{ profile.goals or '' }}</textarea>
+
+        <div class="grid">
+            <a href="/profiles" role="button" class="outline secondary">Cancel</a>
+            <button type="submit">Save Changes</button>
+        </div>
+    </form>
+</article>
+{% endblock %}

app/templates/pages/profiles.html

@@ -0,0 +1,16 @@
+{% extends "base.html" %}
+
+{% block title %}User Profiles — SneakySwole{% endblock %}
+
+{% block content %}
+<hgroup>
+    <h1>User Profiles</h1>
+    <p>Manage training profiles.</p>
+</hgroup>
+
+<div class="grid">
+    {% for profile in profiles %}
+        {% include "partials/profile_card.html" %}
+    {% endfor %}
+</div>
+{% endblock %}

app/templates/pages/workout_day.html

@@ -0,0 +1,31 @@
+{% extends "base.html" %}
+
+{% block title %}{{ day_name }} Day — SneakySwole{% endblock %}
+
+{% block content %}
+<hgroup>
+    <h1>{{ day_name }} Day</h1>
+    {% if active_profile %}
+    <p>Training as: <strong>{{ active_profile.display_name }}</strong></p>
+    {% else %}
+    <p>No profile selected — <a href="/profiles">select one</a></p>
+    {% endif %}
+</hgroup>
+
+<!-- Warmup Section -->
+<section>
+    <h2>Warmup</h2>
+    {% include "partials/warmup_list.html" %}
+</section>
+
+<!-- Exercises Section -->
+<section>
+    <h2>Exercises</h2>
+    {% for exercise in exercises %}
+        {% set program = programs.get(exercise.id) %}
+        {% include "partials/exercise_card.html" %}
+    {% endfor %}
+</section>
+
+<a href="/workouts" role="button" class="outline">Back to All Days</a>
+{% endblock %}

app/templates/pages/workout_days.html

@@ -0,0 +1,22 @@
+{% extends "base.html" %}
+
+{% block title %}Workout Days — SneakySwole{% endblock %}
+
+{% block content %}
+<h1>Workout Days</h1>
+
+<div class="grid">
+    {% for day in days %}
+    <article>
+        <header>
+            <h3>Day {{ day.day_number }}: {{ day.name }}</h3>
+        </header>
+        <p>{{ day.description }}</p>
+        <footer>
+            <a href="/workouts/{{ day.name|lower|replace(' ', '-') }}"
+               role="button">View Workout</a>
+        </footer>
+    </article>
+    {% endfor %}
+</div>
+{% endblock %}