refactor: code consistency and best practices

- add type hints to error handlers in app/__init__.py
- add docstrings to nested callback functions
- remove deprecated X-XSS-Protection header (superseded by CSP)
- fix typo in cleanup log message (entr(ies) -> entries)
- standardize loop variable naming in fpaste CLI
- update test for intentional header removal

fpaste

@@ -640,7 +640,7 @@ def cmd_delete(args: argparse.Namespace, config: dict[str, Any]) -> None:
 
     delete_all = getattr(args, "all", False)
     confirm_count = getattr(args, "confirm", None)
-    paste_ids = [pid.split("/")[-1] for pid in (args.ids or [])]
+    paste_ids = [paste_id.split("/")[-1] for paste_id in (args.ids or [])]
 
     # Validate arguments
     if delete_all and paste_ids:
@@ -890,20 +890,20 @@ def cmd_export(args: argparse.Namespace, config: dict[str, Any]) -> None:
     exported, skipped, errors = 0, 0, 0
     manifest: list[dict[str, Any]] = []
 
-    for p in pastes:
-        paste_id = p["id"]
-        mime_type = p.get("mime_type", "application/octet-stream")
+    for paste in pastes:
+        paste_id = paste["id"]
+        mime_type = paste.get("mime_type", "application/octet-stream")
 
         if not args.quiet:
             print(f"exporting {paste_id}...", end=" ", file=sys.stderr)
 
-        if p.get("burn_after_read"):
+        if paste.get("burn_after_read"):
             if not args.quiet:
                 print("skipped (burn-after-read)", file=sys.stderr)
             skipped += 1
             continue
 
-        if p.get("password_protected"):
+        if paste.get("password_protected"):
             if not args.quiet:
                 print("skipped (password-protected)", file=sys.stderr)
             skipped += 1
@@ -939,7 +939,7 @@ def cmd_export(args: argparse.Namespace, config: dict[str, Any]) -> None:
                 "filename": filename,
                 "mime_type": mime_type,
                 "size": len(content),
-                "created_at": p.get("created_at"),
+                "created_at": paste.get("created_at"),
                 "decrypted": decrypted,
                 "encrypted": paste_id in keys and not decrypted,
             }