Code review fixes: wardrobe migration, response validation, path traversal guard, deduplication

- Migrate 11 character JSONs from old wardrobe keys to _BODY_GROUP_KEYS format
- Add is_favourite/is_nsfw columns to Preset model
- Add HTTP response validation and timeouts to ComfyUI client
- Add path traversal protection on replace cover route
- Deduplicate services/mcp.py (4 functions → 2 generic + 2 wrappers)
- Extract apply_library_filters() and clean_html_text() shared helpers
- Add named constants for 17 ComfyUI workflow node IDs
- Fix bare except clauses in services/llm.py
- Fix tags schema in ensure_default_outfit() (list → dict)
- Convert f-string logging to lazy % formatting
- Add 5-minute polling timeout to frontend waitForJob()
- Improve migration error handling (non-duplicate errors log at WARNING)
- Update CLAUDE.md to reflect all changes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

routes/settings.py

@@ -62,7 +62,7 @@ def register_routes(app):
             db.session.commit()
             logger.info("Default checkpoint saved to database: %s", checkpoint_path)
         except Exception as e:
-            logger.error(f"Failed to persist checkpoint to database: {e}")
+            logger.error("Failed to persist checkpoint to database: %s", e)
             db.session.rollback()
 
         # Also persist to comfy_workflow.json for backwards compatibility
@@ -78,7 +78,7 @@ def register_routes(app):
                 with open(workflow_path, 'w') as f:
                     json.dump(workflow, f, indent=2)
         except Exception as e:
-            logger.error(f"Failed to persist checkpoint to workflow file: {e}")
+            logger.error("Failed to persist checkpoint to workflow file: %s", e)
 
         return {'status': 'ok'}