feat: add Phase 3 Workout UI — auth, profiles, workout viewer, exercise browser

Build the core user-facing experience with admin login (bcrypt + signed
session cookies), profile switcher, workout day viewer with warmups and
exercise cards, and HTMX-powered exercise browser with search/filter.

- AuthService with bcrypt password verification and itsdangerous session tokens
- Auth dependency redirects to /login (303) for unauthenticated requests
- NavContextMiddleware injects admin/profiles/active_profile into all templates
- Profile management (list, switch, edit) with cookie-based active profile
- Workout day viewer shows warmups + exercises + per-user programming targets
- Exercise browser with HTMX filter dropdowns (no page reloads)
- Flash message partial for success/error feedback
- 12 new tests (66 total passing)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/roadmap.md

@@ -25,16 +25,42 @@ Build the database schema and seed it from YAML config files.
 - Two initial user profiles seeded: Phillip and Daughter
 - Service layer for all DB access (no direct queries from routes)
 
-## Phase 3: Workout UI
+### Phase 3: Workout UI ✅
 
-The core user-facing experience — viewing workouts and managing profiles.
+**Completed:** 2026-02-24
 
-- Admin login (simple session-based auth, password hashed)
-- Profile switcher in nav (admin selects active user profile)
-- Admin can create and edit user profiles (name, weight, height, goals)
-- Workout day viewer — warmup routine + main exercises with full form cues
-- Exercise library browser (search/filter by muscle group, workout day)
-- All interactions via HTMX partials (no JSON APIs, no vanilla JS)
+**Summary:** Built the core user-facing experience — admin login with bcrypt + signed session cookies, profile switcher, workout day viewer with warmups and exercise cards, and HTMX-powered exercise browser with search/filter. Added Jinja2 context processor middleware for automatic nav context injection.
+
+**Key files:**
+- `app/services/auth_service.py` — AuthService (bcrypt auth + itsdangerous session tokens)
+- `app/utils/auth.py` — `get_current_admin_user` (303 redirect to /login), `get_active_profile_id`
+- `app/routes/auth.py` — login/logout routes
+- `app/routes/profiles.py` — profile list, switch, edit routes
+- `app/routes/workouts.py` — workout day list + detail viewer
+- `app/routes/exercises.py` — exercise browser with HTMX search
+- `app/templates/partials/nav.html` — profile switcher dropdown (reads from request.state)
+- `app/main.py` — NavContextMiddleware, secret_key, all routers registered
+
+**Endpoints created:**
+- `GET /login` — render login form
+- `POST /login` — authenticate and set session cookie
+- `GET /logout` — clear session, redirect to /login
+- `GET /profiles` — list user profiles
+- `POST /profiles/switch` — set active profile cookie
+- `GET /profiles/{id}/edit` — profile edit form
+- `POST /profiles/{id}/edit` — update profile
+- `GET /workouts` — workout day cards
+- `GET /workouts/{day_name}` — warmups + exercises + programming targets
+- `GET /exercises` — exercise browser with filter dropdowns
+- `GET /exercises/search` — HTMX partial for filtered exercise list
+
+**Key details:**
+- Auth uses 303 redirect to /login (not 401) for browser UX
+- Nav context injected via `NavContextMiddleware` into `request.state` (admin, profiles, active_profile)
+- Session cookie: httponly=True, samesite="lax", max_age=86400 (24h)
+- `itsdangerous>=2.2.0` added to requirements.txt
+- `python-multipart>=0.0.20` added for form data parsing
+- 66 tests pass (12 new Phase 3 tests + 54 existing)
 
 ## Phase 4: Logging & Tracking