Code review fixes: wardrobe migration, response validation, path traversal guard, deduplication

- Migrate 11 character JSONs from old wardrobe keys to _BODY_GROUP_KEYS format
- Add is_favourite/is_nsfw columns to Preset model
- Add HTTP response validation and timeouts to ComfyUI client
- Add path traversal protection on replace cover route
- Deduplicate services/mcp.py (4 functions → 2 generic + 2 wrappers)
- Extract apply_library_filters() and clean_html_text() shared helpers
- Add named constants for 17 ComfyUI workflow node IDs
- Fix bare except clauses in services/llm.py
- Fix tags schema in ensure_default_outfit() (list → dict)
- Convert f-string logging to lazy % formatting
- Add 5-minute polling timeout to frontend waitForJob()
- Improve migration error handling (non-duplicate errors log at WARNING)
- Update CLAUDE.md to reflect all changes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

static/js/library-toolbar.js

@@ -28,9 +28,15 @@ document.addEventListener('DOMContentLoaded', () => {
     const bulkOverwriteBtn = document.getElementById('bulk-overwrite-btn');
 
     // --- Utility: poll a job until done ---
-    function waitForJob(jobId) {
+    function waitForJob(jobId, maxPollMs = 300000) {
         return new Promise((resolve, reject) => {
+            const start = Date.now();
             const poll = setInterval(async () => {
+                if (Date.now() - start > maxPollMs) {
+                    clearInterval(poll);
+                    reject(new Error('Job timed out after ' + Math.round(maxPollMs / 1000) + 's'));
+                    return;
+                }
                 try {
                     const resp = await fetch(`/api/queue/${jobId}/status`);
                     const data = await resp.json();