Code review fixes: wardrobe migration, response validation, path traversal guard, deduplication

- Migrate 11 character JSONs from old wardrobe keys to _BODY_GROUP_KEYS format
- Add is_favourite/is_nsfw columns to Preset model
- Add HTTP response validation and timeouts to ComfyUI client
- Add path traversal protection on replace cover route
- Deduplicate services/mcp.py (4 functions → 2 generic + 2 wrappers)
- Extract apply_library_filters() and clean_html_text() shared helpers
- Add named constants for 17 ComfyUI workflow node IDs
- Fix bare except clauses in services/llm.py
- Fix tags schema in ensure_default_outfit() (list → dict)
- Convert f-string logging to lazy % formatting
- Add 5-minute polling timeout to frontend waitForJob()
- Improve migration error handling (non-duplicate errors log at WARNING)
- Update CLAUDE.md to reflect all changes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

routes/presets.py

@@ -8,7 +8,7 @@ from sqlalchemy.orm.attributes import flag_modified
 from services.sync import sync_presets
 from services.generation import generate_from_preset
 from services.llm import load_prompt, call_llm
-from routes.shared import register_common_routes
+from routes.shared import register_common_routes, apply_library_filters
 
 logger = logging.getLogger('gaze')
 
@@ -18,8 +18,9 @@ def register_routes(app):
 
     @app.route('/presets')
     def presets_index():
-        presets = Preset.query.order_by(Preset.filename).all()
-        return render_template('presets/index.html', presets=presets)
+        presets, fav, nsfw = apply_library_filters(Preset.query, Preset)
+        return render_template('presets/index.html', presets=presets,
+                               favourite_filter=fav, nsfw_filter=nsfw)
 
     @app.route('/preset/<path:slug>')
     def preset_detail(slug):