feat: add Phase 3 Workout UI — auth, profiles, workout viewer, exercise browser

Build the core user-facing experience with admin login (bcrypt + signed
session cookies), profile switcher, workout day viewer with warmups and
exercise cards, and HTMX-powered exercise browser with search/filter.

- AuthService with bcrypt password verification and itsdangerous session tokens
- Auth dependency redirects to /login (303) for unauthenticated requests
- NavContextMiddleware injects admin/profiles/active_profile into all templates
- Profile management (list, switch, edit) with cookie-based active profile
- Workout day viewer shows warmups + exercises + per-user programming targets
- Exercise browser with HTMX filter dropdowns (no page reloads)
- Flash message partial for success/error feedback
- 12 new tests (66 total passing)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

requirements.txt

@@ -4,6 +4,8 @@ jinja2>=3.1.0,<4.0.0
 structlog>=24.0.0,<25.0.0
 python-dotenv>=1.0.0,<2.0.0
 bcrypt>=4.2.0,<5.0.0
+itsdangerous>=2.2.0,<3.0.0
+python-multipart>=0.0.20,<1.0.0
 pyyaml>=6.0.0,<7.0.0
 sqlmodel>=0.0.22,<1.0.0
 alembic>=1.14.0,<2.0.0