feat: add Phase 4 Logging & Tracking — inline set logging, history views

Add workout logging so users can track sets, reps, weight, and a
"felt easy?" toggle inline from the workout day view via HTMX.
Sessions auto-create on first log. History page shows past sessions
with detailed per-exercise breakdowns.

New services: WorkoutSessionService, LogService
New routes: POST /log, /log/{id}/edit, /log/{id}/delete, GET /history, /history/{id}
New templates: log_form, log_entry, session_card, log_history, session_detail
Modified: exercise_card (inline logging), nav (History link), workouts route (session context)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/test_logging_routes.py

@@ -0,0 +1,44 @@
+"""Tests for workout logging routes."""
+
+from fastapi.testclient import TestClient
+
+
+class TestLogSet:
+    """Tests for POST /log."""
+
+    def test_log_set_requires_auth(self, client: TestClient) -> None:
+        """POST /log should require admin login."""
+        response = client.post(
+            "/log",
+            data={
+                "exercise_id": "1",
+                "workout_day_id": "1",
+                "set_number": "1",
+                "reps": "8",
+                "weight": "30 lbs",
+            },
+            follow_redirects=False,
+        )
+        assert response.status_code in (401, 303)
+
+
+class TestLogEdit:
+    """Tests for POST /log/<id>/edit."""
+
+    def test_edit_log_requires_auth(self, client: TestClient) -> None:
+        """POST /log/1/edit should require admin login."""
+        response = client.post(
+            "/log/1/edit",
+            data={"reps": "10", "weight": "35 lbs"},
+            follow_redirects=False,
+        )
+        assert response.status_code in (401, 303)
+
+
+class TestLogDelete:
+    """Tests for POST /log/<id>/delete."""
+
+    def test_delete_log_requires_auth(self, client: TestClient) -> None:
+        """POST /log/1/delete should require admin login."""
+        response = client.post("/log/1/delete", follow_redirects=False)
+        assert response.status_code in (401, 303)