Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@web/management/commands/cleanup_expired_messages.py`:
- Line 12: The handle function in cleanup_expired_messages.py lacks type hints
and a docstring; add Python typing and documentation by annotating def
handle(self, *args: Any, **options: Any) -> None (import Any from typing) and
add a concise docstring at the top of the function describing its purpose (e.g.,
"Execute the management command to remove expired messages"), the expected
args/options usage, and return behavior; ensure imports (typing.Any) are present
and follow the repo's docstring style.

In `@web/secure_messaging.py`:
- Around line 192-197: The 7-day retention cutoff is duplicated between
cleanup_expired_peer_messages and
web/management/commands/cleanup_expired_messages.py which risks drift; extract
the retention value and cutoff calculation into a single shared symbol (e.g.,
MESSAGE_RETENTION_DAYS constant and/or a get_message_retention_cutoff() helper)
in a common module (settings or a new web/retention.py) and refactor
cleanup_expired_peer_messages and the management command to import and use that
shared constant/helper (reference: function cleanup_expired_peer_messages and
the management command in web/management/commands/cleanup_expired_messages.py).
- Around line 179-189: The view currently calls json.loads(request.body) without
handling malformed JSON and uses
PeerMessage.objects.filter(...).update(is_read=True) which bypasses save() and
leaves read_at unset; wrap the JSON parsing in a try/except for
json.JSONDecodeError and return a 400 JSON response on failure, and when marking
messages read set the timestamp as well (e.g. use
PeerMessage.objects.filter(sender=sender, receiver=request.user,
is_read=False).update(is_read=True, read_at=timezone.now()) or iterate and call
save() if per-object logic is needed); ensure you import json and
django.utils.timezone.now and keep the existing User lookup (get_user_model /
User.objects.get) and error responses.

In `@web/templates/web/messaging/dashboard.html`:
- Around line 131-137: Server-rendered usernames are inserted into JS without
escaping which can break scripts or allow injection; update the template so
chatData["{{ person.username }}"], the sender field "{{ msg.sender }}", and the
occurrences of request.user.username (lines referenced around 387–389) use the
Django escapejs filter (e.g., "{{ person.username|escapejs }}", "{{
msg.sender|escapejs }}", "{{ request.user.username|escapejs }}") so the values
are safely escaped for embedding in JavaScript string literals and bracket keys.
- Around line 28-29: The template adds custom CSS classes (person-btn,
person-unread-badge, message-star-btn) which violate the "Never use custom CSS
classes" rule — replace those class hooks with data-* attributes (e.g., change
class="... person-btn" to remove person-btn and add data-person-btn, replace
person-unread-badge with data-person-unread-badge, and message-star-btn with
data-message-star-btn) and update any JS/CSS that references these classes to
use the new data-* selectors (search for usages of person-btn,
person-unread-badge, message-star-btn and update them to
querySelector/querySelectorAll('[data-person-btn]') etc.); apply the same
replacements for the other occurrences noted in the template (lines mentioned in
the review).

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@web/management/commands/cleanup_expired_messages.py`:
- Around line 23-24: The code does an extra COUNT() by calling
expired_qs.count() before expired_qs.delete(); remove the separate count() and
use delete()'s return value instead—call expired_qs.delete(), capture its first
element (the number of rows deleted) and use that for reporting; update any
references to the old count variable to use the delete() result and drop the
now-unused expired_qs.count() call.

In `@web/secure_messaging.py`:
- Around line 308-350: The loop over user_ids causes N+1 queries (per-user User
lookup, avatar/profile access, per-conversation PeerMessage query, and unread
check). Fix by preloading data: fetch all User objects for user_ids in one query
(use User.objects.filter(id__in=...).select_related('profile') to get
profiles/avatars and avoid per-user profile hits), load all relevant PeerMessage
rows in a single query (PeerMessage.objects.filter(models.Q(sender=request.user,
receiver__in=user_ids) | models.Q(receiver=request.user,
sender__in=user_ids)).order_by('created_at') ) and group them in-memory by the
other party to build msg_list and compute has_unread counts (use annotations
like .annotate(unread=Count('id', filter=Q(receiver=request.user,
is_read=False))) or aggregate unread per sender in one query) and then iterate
over the in-memory maps to call sanitize_svg and decrypt_message_with_random_key
without additional DB calls.

In `@web/templates/web/messaging/dashboard.html`:
- Line 30: The data-person HTML attribute is using escapejs which produces
literal escape sequences and breaks lookups against the chatData keys; remove
the escapejs filter from the data-person attribute (i.e., render person.username
unescaped for HTML attribute context) so that getAttribute('data-person')
returns the real username that matches the chatData keys used in the JavaScript
(chatData and the code that builds/looks up entries).

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@web/secure_messaging.py`:
- Around line 358-362: The decryption except block swallows errors; change it to
capture the exception (except Exception as e) and log it (e.g., logger.exception
or logger.error with the exception) together with contextual identifiers from
the message (such as msg.id or msg.message_id and msg.encrypted_key) before
setting decrypted_message = "[Error decrypting message]"; use the existing
module logger (or create one) and prefer logger.exception to include the
traceback for decrypt_message_with_random_key failures.

In `@web/templates/web/messaging/dashboard.html`:
- Around line 309-317: The avatar fallback inserts trimmed server-rendered text
into innerHTML (see btn, img, fallback, chatPersonAvatar), so add
defense-in-depth by escaping the fallback string before embedding it: use or
implement an escapeHTML utility and replace fallback.textContent.trim() with
escapeHTML(fallback.textContent.trim()) (or set chatPersonAvatar.textContent for
the fallback branch) to ensure any future user-controlled data is safely
encoded.
- Around line 147-164: The openNewChatUI function uses
chatPersonAvatar.innerHTML with username.charAt(0) which can introduce XSS;
sanitize the username before inserting into the DOM by using the existing
escapeHTML utility and inject the escaped single-character avatar content (or
better, set textContent on a created element instead of raw innerHTML). Update
openNewChatUI to call escapeHTML(username) (or escapeHTML(username.charAt(0)))
and use that escaped value when populating chatPersonAvatar, keeping
chatPersonName.textContent and chat-recipient.value logic unchanged.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/codeql.yml:
- Line 76: The workflow uses an absolute path for the github/codeql-action/init
input `source-root` (currently set to `${{ github.workspace }}`); change
`source-root` to a relative value such as `.` or remove the `source-root` key
entirely so it relies on the default (relative to $GITHUB_WORKSPACE) when
invoking the `github/codeql-action/init` step.