Code review fixes: wardrobe migration, response validation, path traversal guard, deduplication

- Migrate 11 character JSONs from old wardrobe keys to _BODY_GROUP_KEYS format
- Add is_favourite/is_nsfw columns to Preset model
- Add HTTP response validation and timeouts to ComfyUI client
- Add path traversal protection on replace cover route
- Deduplicate services/mcp.py (4 functions → 2 generic + 2 wrappers)
- Extract apply_library_filters() and clean_html_text() shared helpers
- Add named constants for 17 ComfyUI workflow node IDs
- Fix bare except clauses in services/llm.py
- Fix tags schema in ensure_default_outfit() (list → dict)
- Convert f-string logging to lazy % formatting
- Add 5-minute polling timeout to frontend waitForJob()
- Improve migration error handling (non-duplicate errors log at WARNING)
- Update CLAUDE.md to reflect all changes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

routes/transfer.py

@@ -244,7 +244,7 @@ Generate a complete {target_category.rstrip('s')} profile with all required fiel
                     new_data[target_name_key] = new_name
 
                 except Exception as e:
-                    logger.exception(f"LLM transfer error: {e}")
+                    logger.exception("LLM transfer error: %s", e)
                     flash(f'Failed to generate {target_category.rstrip("s")} with AI: {e}')
                     return redirect(url_for('transfer_resource', category=category, slug=slug))
             else:
@@ -290,7 +290,7 @@ Generate a complete {target_category.rstrip('s')} profile with all required fiel
                                 lora_moved = True
                                 flash(f'Moved LoRA file to {target_lora_dir}')
                             except Exception as lora_e:
-                                logger.exception(f"LoRA move error: {lora_e}")
+                                logger.exception("LoRA move error: %s", lora_e)
                                 flash(f'Warning: Failed to move LoRA file: {lora_e}', 'warning')
                         else:
                             flash(f'Warning: Source LoRA file not found at {abs_source_path}', 'warning')
@@ -317,7 +317,7 @@ Generate a complete {target_category.rstrip('s')} profile with all required fiel
                         db.session.delete(resource)
                         flash(f'Removed original {category.rstrip("s")}: {resource_name}')
                     except Exception as rm_e:
-                        logger.exception(f"Error removing original: {rm_e}")
+                        logger.exception("Error removing original: %s", rm_e)
                         flash(f'Warning: Failed to remove original: {rm_e}', 'warning')
 
                 db.session.commit()
@@ -325,7 +325,7 @@ Generate a complete {target_category.rstrip('s')} profile with all required fiel
                 return redirect(url_for(target_config['index_route'], highlight=safe_slug))
 
             except Exception as e:
-                logger.exception(f"Transfer save error: {e}")
+                logger.exception("Transfer save error: %s", e)
                 flash(f'Failed to save transferred {target_category.rstrip("s")}: {e}')
                 return redirect(url_for('transfer_resource', category=category, slug=slug))