=== subjects.py clear-all ===
@router.post("/clear-all")
async def clear_all(user: User = Depends(get_current_user_csrf), db: AsyncSession = Depends(get_db)):
    await db.execute(sa_delete(SubjectLine).where(SubjectLine.user_id == user.id))
    await db.commit()
    return {"ok": True}
=== templates.py clear-all ===
@router.post("/clear-all")
async def clear_all(user: User = Depends(get_current_user_csrf), db: AsyncSession = Depends(get_db)):
    await db.execute(sa_delete(EmailTemplate).where(EmailTemplate.user_id == user.id))
    await db.commit()
    return {"ok": True}

=== main.py CSP ===
36:        response.headers.setdefault("Content-Security-Policy",
38:                                    " script-src 'self'; frame-src 'self' data: blob:;"
=== attachments.js modal download ===
22:            <button class="btn xs secondary" data-dl="${a.id}">Download</button>
81:    if (b.dataset.dl) window.open(`/attachments/${id}/download`, "_blank");
99:                { label:"Download", kind:"btn", onClick: () => { window.open(`/attachments/${id}/download`, "_blank"); } },
100:                { label:"Open in new tab", onClick: () => { const w = window.open("", "_blank"); if (w) { w.document.write(`<title>${a.name.replace(/</g,"&lt;")}</title><iframe src="${d.data_uri}" style="width:100%;height:100%;border:0"></iframe>`); w.document.close(); } } },