Code review fixes: wardrobe migration, response validation, path traversal guard, deduplication

- Migrate 11 character JSONs from old wardrobe keys to _BODY_GROUP_KEYS format
- Add is_favourite/is_nsfw columns to Preset model
- Add HTTP response validation and timeouts to ComfyUI client
- Add path traversal protection on replace cover route
- Deduplicate services/mcp.py (4 functions → 2 generic + 2 wrappers)
- Extract apply_library_filters() and clean_html_text() shared helpers
- Add named constants for 17 ComfyUI workflow node IDs
- Fix bare except clauses in services/llm.py
- Fix tags schema in ensure_default_outfit() (list → dict)
- Convert f-string logging to lazy % formatting
- Add 5-minute polling timeout to frontend waitForJob()
- Improve migration error handling (non-duplicate errors log at WARNING)
- Update CLAUDE.md to reflect all changes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

models.py

@@ -271,7 +271,7 @@ class Checkpoint(db.Model):
     slug = db.Column(db.String(255), unique=True, nullable=False)
     name = db.Column(db.String(255), nullable=False)
     checkpoint_path = db.Column(db.String(255), nullable=False)  # e.g. "Illustrious/model.safetensors"
-    data = db.Column(db.JSON, nullable=True)
+    data = db.Column(db.JSON, nullable=False, default=dict)
     image_path = db.Column(db.String(255), nullable=True)
     is_favourite = db.Column(db.Boolean, default=False)
     is_nsfw = db.Column(db.Boolean, default=False)
@@ -287,6 +287,8 @@ class Preset(db.Model):
     name = db.Column(db.String(100), nullable=False)
     data = db.Column(db.JSON, nullable=False)
     image_path = db.Column(db.String(255), nullable=True)
+    is_favourite = db.Column(db.Boolean, default=False)
+    is_nsfw = db.Column(db.Boolean, default=False)
 
     def __repr__(self):
         return f'<Preset {self.preset_id}>'