Code review fixes: wardrobe migration, response validation, path traversal guard, deduplication

- Migrate 11 character JSONs from old wardrobe keys to _BODY_GROUP_KEYS format
- Add is_favourite/is_nsfw columns to Preset model
- Add HTTP response validation and timeouts to ComfyUI client
- Add path traversal protection on replace cover route
- Deduplicate services/mcp.py (4 functions → 2 generic + 2 wrappers)
- Extract apply_library_filters() and clean_html_text() shared helpers
- Add named constants for 17 ComfyUI workflow node IDs
- Fix bare except clauses in services/llm.py
- Fix tags schema in ensure_default_outfit() (list → dict)
- Convert f-string logging to lazy % formatting
- Add 5-minute polling timeout to frontend waitForJob()
- Improve migration error handling (non-duplicate errors log at WARNING)
- Update CLAUDE.md to reflect all changes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app.py

@@ -69,6 +69,7 @@ if __name__ == '__main__':
         from sqlalchemy import text
 
         os.makedirs(app.config['UPLOAD_FOLDER'], exist_ok=True)
+        os.makedirs(app.config['SESSION_FILE_DIR'], exist_ok=True)
         db.create_all()
 
         # --- Helper for safe column additions ---
@@ -79,8 +80,11 @@ if __name__ == '__main__':
                 logger.info("Added %s.%s column", table, column)
             except Exception as e:
                 db.session.rollback()
-                if 'duplicate column name' not in str(e).lower() and 'already exists' not in str(e).lower():
-                    logger.debug("Migration note (%s.%s): %s", table, column, e)
+                err_str = str(e).lower()
+                if 'duplicate column name' in err_str or 'already exists' in err_str:
+                    pass  # Column already exists, expected
+                else:
+                    logger.warning("Migration failed (%s.%s): %s", table, column, e)
 
         # --- All migrations (grouped before syncs) ---
         _add_column('character', 'active_outfit', "VARCHAR(100) DEFAULT 'default'")
@@ -106,7 +110,7 @@ if __name__ == '__main__':
             _add_column('settings', col_name, col_type)
 
         # is_favourite / is_nsfw on all resource tables
-        for tbl in ['character', 'look', 'outfit', 'action', 'style', 'scene', 'detailer', 'checkpoint']:
+        for tbl in ['character', 'look', 'outfit', 'action', 'style', 'scene', 'detailer', 'checkpoint', 'preset']:
             _add_column(tbl, 'is_favourite', 'BOOLEAN DEFAULT 0')
             _add_column(tbl, 'is_nsfw', 'BOOLEAN DEFAULT 0')