Code review fixes: wardrobe migration, response validation, path traversal guard, deduplication

- Migrate 11 character JSONs from old wardrobe keys to _BODY_GROUP_KEYS format
- Add is_favourite/is_nsfw columns to Preset model
- Add HTTP response validation and timeouts to ComfyUI client
- Add path traversal protection on replace cover route
- Deduplicate services/mcp.py (4 functions → 2 generic + 2 wrappers)
- Extract apply_library_filters() and clean_html_text() shared helpers
- Add named constants for 17 ComfyUI workflow node IDs
- Fix bare except clauses in services/llm.py
- Fix tags schema in ensure_default_outfit() (list → dict)
- Convert f-string logging to lazy % formatting
- Add 5-minute polling timeout to frontend waitForJob()
- Improve migration error handling (non-duplicate errors log at WARNING)
- Update CLAUDE.md to reflect all changes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

services/prompts.py

@@ -1,6 +1,6 @@
 import re
 from models import db, Character
-from utils import _IDENTITY_KEYS, _WARDROBE_KEYS, _BODY_GROUP_KEYS, parse_orientation
+from utils import _BODY_GROUP_KEYS, parse_orientation
 
 
 def _dedup_tags(prompt_str):
@@ -57,7 +57,7 @@ def _ensure_character_fields(character, selected_fields, include_wardrobe=True,
     include_defaults  — also inject defaults::expression and defaults::pose (for outfit/look previews)
     """
     identity = character.data.get('identity', {})
-    for key in _IDENTITY_KEYS:
+    for key in _BODY_GROUP_KEYS:
         if identity.get(key):
             field_key = f'identity::{key}'
             if field_key not in selected_fields:
@@ -72,7 +72,7 @@ def _ensure_character_fields(character, selected_fields, include_wardrobe=True,
         selected_fields.append('special::name')
     if include_wardrobe:
         wardrobe = character.get_active_wardrobe()
-        for key in _WARDROBE_KEYS:
+        for key in _BODY_GROUP_KEYS:
             if wardrobe.get(key):
                 field_key = f'wardrobe::{key}'
                 if field_key not in selected_fields: