fix: address code review - clarify plaintext note, fix misleading template ternary

Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/0c63851e-a69a-4a76-8dd8-25618e825b8c

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

backend/app/models/mail_source.py

@@ -39,7 +39,10 @@ class MailSource(Base):
     folder = Column(String, default="INBOX")
 
     # Gmail API OAuth2 credentials (used by GMAIL_API method)
-    # NOTE: tokens stored in plaintext – encrypt at the app layer in production.
+    # NOTE: tokens and secrets are stored in plaintext – in a production
+    # environment these fields should be encrypted at the application layer
+    # (e.g. using Fernet/AES) before persisting, the same way IMAP passwords
+    # should be.  Treat database access as equivalent to credential access.
     gmail_client_id = Column(String, nullable=True)
     gmail_client_secret = Column(Text, nullable=True)
     gmail_access_token = Column(Text, nullable=True)

backend/app/services/gmail_client.py

@@ -11,7 +11,7 @@ import base64
 import email
 import json
 import logging
-from typing import Any, Dict, List, Optional, Tuple
+from typing import Any, Dict, List, Optional
 from urllib.parse import urlencode
 
 import httpx
@@ -295,10 +295,7 @@ class GmailClient:
         """
         try:
             msg_data = (
-                service.users()
+                service.users().messages().get(userId="me", id=msg_id, format="raw").execute()
-                .messages()
-                .get(userId="me", id=msg_id, format="raw")
-                .execute()
             )
         except HttpError as exc:
             logger.error("Gmail API: failed to fetch message %s: %s", msg_id, exc)

backend/app/templates/mail_sources.html

@@ -463,7 +463,7 @@ function mailSourcesApp() {
                 polling_interval: source.polling_interval || 60,
                 enabled: source.enabled !== false,
                 gmail_client_id: source.gmail_client_id || '',
-                gmail_client_secret: source.gmail_client_secret ? '' : '',  // never pre-fill
+                gmail_client_secret: '',  // never pre-fill client secret
             };
             this.testResult = { message: '', success: false };
             this.showForm = true;