@router.post("/upload-multiple")
async def upload_multiple(files: list[UploadFile] = File(...),
                          user: User = Depends(get_current_user_csrf),
                          db: AsyncSession = Depends(get_db)):
    created = []
    for f in files:
        fname = (f.filename or "").lower()
        if not fname.endswith((".html", ".htm", ".txt")):
            continue
        content = (await f.read()).decode("utf-8", errors="replace")
        if len(content) > 1024 * 1024 or re.search(r"<script", content, re.I):
            continue
        row = EmailTemplate(user_id=user.id, name=f.filename[:250], body_html=content,
                            source="upload")
        db.add(row)
        created.append(f.filename)
    await db.commit()
    return {"ok": True, "created": created, "count": len(created)}


@router.get("/{template_id}")
async def get_template(template_id: int, user: User = Depends(get_current_user),
                       db: AsyncSession = Depends(get_db)):
    t = await db.get(EmailTemplate, template_id)
    if not t or t.user_id != user.id: