refactor: code consistency and best practices

- add type hints to error handlers in app/__init__.py
- add docstrings to nested callback functions
- remove deprecated X-XSS-Protection header (superseded by CSP)
- fix typo in cleanup log message (entr(ies) -> entries)
- standardize loop variable naming in fpaste CLI
- update test for intentional header removal

tests/test_security.py

@@ -16,10 +16,10 @@ class TestSecurityHeaders:
         response = client.get("/")
         assert response.headers.get("X-Frame-Options") == "DENY"
 
-    def test_x_xss_protection(self, client):
-        """X-XSS-Protection header is set."""
+    def test_x_xss_protection_not_present(self, client):
+        """X-XSS-Protection header is not set (deprecated, superseded by CSP)."""
         response = client.get("/")
-        assert response.headers.get("X-XSS-Protection") == "1; mode=block"
+        assert response.headers.get("X-XSS-Protection") is None
 
     def test_content_security_policy(self, client):
         """Content-Security-Policy header is set."""