return _page("❌", "Invalid link", "This unsubscribe link is invalid.")
    rec = (await db.execute(
        select(Recipient).where(Recipient.unsub_token == token))).scalar()
    if not rec:
        return _page("❌", "Invalid link",
                     "We could not find this unsubscribe link.")

    email = rec.email
    existing = (await db.execute(
        select(SuppressionEntry).where(SuppressionEntry.email == email))).scalar()
    if not existing:
        db.add(SuppressionEntry(user_id=rec.list.user_id if rec.list else None,
                                email=email, reason="unsubscribed",
                                source="unsubscribe-link"))
        await db.commit()

    # record event on the most recent campaign_recipient for this email (if any)
    cr = (await db.execute(
        select(CampaignRecipient).where(CampaignRecipient.email == email)
        .order_by(CampaignRecipient.id.desc()).limit(1))).scalar()
    if cr:
        db.add(EmailEvent(campaign_id=cr.campaign_id,
                          campaign_recipient_id=cr.id,
                          event_type="unsubscribed",
                          detail=f"Unsubscribed via token link from {email}"))
        rec.status = "unsubscribed"
==== main.py 25-40

app = FastAPI(title=settings.APP_NAME, lifespan=lifespan,
              docs_url="/api/docs", openapi_url="/api/openapi.json")


class SecurityHeadersMiddleware(BaseHTTPMiddleware):
    async def dispatch(self, request, call_next):
        response = await call_next(request)
        response.headers.setdefault("X-Content-Type-Options", "nosniff")
        response.headers.setdefault("X-Frame-Options", "DENY")
        response.headers.setdefault("Referrer-Policy", "no-referrer")
        response.headers.setdefault("Content-Security-Policy",
                                    "default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline';"
                                    " script-src 'self'; frame-ancestors 'none'")
        if settings.ENVIRONMENT == "production":
            response.headers.setdefault("Strict-Transport-Security", "max-age=63072000; includeSubDomains")