feat: add Phase 3 Workout UI — auth, profiles, workout viewer, exercise browser

Build the core user-facing experience with admin login (bcrypt + signed
session cookies), profile switcher, workout day viewer with warmups and
exercise cards, and HTMX-powered exercise browser with search/filter.

- AuthService with bcrypt password verification and itsdangerous session tokens
- Auth dependency redirects to /login (303) for unauthenticated requests
- NavContextMiddleware injects admin/profiles/active_profile into all templates
- Profile management (list, switch, edit) with cookie-based active profile
- Workout day viewer shows warmups + exercises + per-user programming targets
- Exercise browser with HTMX filter dropdowns (no page reloads)
- Flash message partial for success/error feedback
- 12 new tests (66 total passing)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/templates/partials/warmup_list.html

@@ -0,0 +1,23 @@
+<table>
+    <thead>
+        <tr>
+            <th>Exercise</th>
+            <th>Type</th>
+            <th>Reps</th>
+        </tr>
+    </thead>
+    <tbody>
+        {% for warmup in warmups %}
+        <tr>
+            <td>
+                <details>
+                    <summary>{{ warmup.name }}</summary>
+                    <p>{{ warmup.form_cues }}</p>
+                </details>
+            </td>
+            <td>{{ warmup.type }}</td>
+            <td>{{ warmup.reps }}</td>
+        </tr>
+        {% endfor %}
+    </tbody>
+</table>