Add a community workout library

Workouts were private to their owner with no way to browse or copy
another user's - FavoriteController::toggleWorkout even had a comment
anticipating sharing ("users can still favorite others' workouts if
shared later") that was never followed up on.

Adds an is_public flag workouts can be toggled to from their own page,
a /workouts/community browse+search page, and a copy action that
duplicates a public workout (including all its exercises/sets/reps)
into the copier's own library.

Making this work required splitting workout authorization into two
tiers: authorizeView() (owner, the assigning trainer, or anyone if the
workout is public - read-only) and the existing authorizeWorkout()
(owner or assigning trainer - can add/edit/remove exercises). Deletion
stays strictly owner-only as before. The show page now hides the
"Add Exercise" panel and per-exercise edit/remove controls for viewers
who can see but not manage a workout.

Found and fixed a real Blade compiler quirk via live testing: `@if`
directly after a word character with no space (`exercises@if(...)`)
doesn't compile - Blade's directive regex treats it as email-like text
and leaves it literal - while the matching `@endif` still compiles,
producing invalid mismatched PHP. Fixed by adding a space.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/Http/Controllers/WorkoutController.php

@@ -21,6 +21,64 @@ class WorkoutController extends Controller
         return view('workouts.index', compact('workouts'));
     }
 
+    public function community(Request $request)
+    {
+        $q = trim((string) $request->query('q', ''));
+
+        $workouts = Workout::query()
+            ->where('is_public', true)
+            ->with(['user:id,name', 'items'])
+            ->when($q !== '', fn ($qb) => $qb->where('title', 'like', "%{$q}%"))
+            ->latest()
+            ->paginate(12)
+            ->withQueryString();
+
+        return view('workouts.community', [
+            'workouts' => $workouts,
+            'filters' => ['q' => $q],
+        ]);
+    }
+
+    public function togglePublic(Workout $workout)
+    {
+        if ($workout->user_id !== Auth::id()) {
+            abort(403);
+        }
+        $workout->is_public = !$workout->is_public;
+        $workout->save();
+
+        return back()->with('status', $workout->is_public ? 'Workout is now public' : 'Workout is now private');
+    }
+
+    public function copy(Workout $workout)
+    {
+        if (!$workout->is_public && $workout->user_id !== Auth::id()) {
+            abort(403);
+        }
+
+        $workout->loadMissing('items');
+
+        $copy = Auth::user()->workouts()->create([
+            'title' => $workout->title . ' (copy)',
+            'notes' => $workout->notes,
+            'estimated_minutes' => $workout->estimated_minutes,
+        ]);
+
+        foreach ($workout->items as $item) {
+            $copy->items()->create([
+                'exercise_id' => $item->exercise_id,
+                'position' => $item->position,
+                'sets' => $item->sets,
+                'reps' => $item->reps,
+                'weight' => $item->weight,
+                'rest_seconds' => $item->rest_seconds,
+                'notes' => $item->notes,
+            ]);
+        }
+
+        return redirect()->route('workouts.show', $copy)->with('status', 'Workout copied to your library');
+    }
+
     public function create()
     {
         // Simple create form (builder-like)
@@ -40,8 +98,8 @@ class WorkoutController extends Controller
 
     public function show(Workout $workout)
     {
-        $this->authorizeWorkout($workout);
-        $workout->load(['items.exercise', 'assignedByTrainer']);
+        $this->authorizeView($workout);
+        $workout->load(['items.exercise', 'assignedByTrainer', 'user:id,name']);
         $exercises = Exercise::orderBy('name')->limit(20)->get(['id','name','slug']);
         return view('workouts.show', compact('workout', 'exercises'));
     }
@@ -133,4 +191,14 @@ class WorkoutController extends Controller
         }
         abort(403);
     }
+
+    // Read-only: anyone can view a public workout (to decide whether to copy it),
+    // in addition to everyone authorizeWorkout() already allows.
+    protected function authorizeView(Workout $workout): void
+    {
+        if ($workout->is_public) {
+            return;
+        }
+        $this->authorizeWorkout($workout);
+    }
 }