Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@public/js/messaging.js`:
- Around line 317-331: Improve the polling interval in the DOMContentLoaded
handler so it skips loadActiveThreads, loadPendingRequests, and
refreshChatHistory when document.hidden is true, preventing unnecessary
background requests and DOM replacement while the tab is hidden.

In `@public/messages.html`:
- Line 48: Both inputs in public/messages.html need accessible names: update the
recipient email input at lines 48-48 and the chat message input at lines 96-101
with an aria-label or visually hidden label, using descriptive text such as
“Recipient email address” and “Type a message.”
- Around line 85-103: Update the chat modal container in public/messages.html
lines 85-103 with role="dialog", aria-modal="true", and
aria-labelledby="chat-title". In the chat modal open/close behavior around
public/js/messaging.js lines 220-261, add Escape-key dismissal, move focus into
the modal when opened, and restore focus to the previously focused element when
closed; optionally support closing by clicking the backdrop.

In `@schema.sql`:
- Around line 151-161: Strengthen the message_requests schema by enforcing one
request per user pair at the database level with a partial unique index that
normalizes from_user_id and to_user_id and excludes any intended non-active or
deleted states. Add an activity_id foreign key referencing the activities table
with the appropriate delete behavior, while preserving the existing user foreign
keys and defaults.

In `@src/worker.py`:
- Around line 6771-6789: Replace the per-row user lookups in
api_list_message_requests (src/worker.py lines 6771-6789), api_activity_contacts
(src/worker.py lines 6836-6859), and api_list_message_threads (src/worker.py
lines 6992-7016) with batched users queries using the collected IDs, then build
ID-to-display-name maps before assembling responses; for
api_list_message_threads, also consider aggregating the per-thread unread check.
- Around line 6817-6859: Restrict the contact-discovery flow after the access
check so users admitted solely through their interest cannot enumerate activity
participants or receive decrypted names. Update the gate and surrounding logic
to require verified enrollment or host status for participant lookup, or
otherwise withhold names until the relevant message request is mutually
accepted; preserve existing behavior for hosts and enrollees.
- Around line 6900-6903: Update the auto-created message request in the activity
flow to preserve recipient consent: insert it with a pending status instead of
accepted, while keeping the existing request identifiers, participants, source,
activity, and timestamp unchanged. Ensure the recipient must explicitly accept
before the thread becomes open and writable.
- Around line 6746-6755: Update api_respond_to_message_request so its
message_requests UPDATE only matches rows whose current status is 'pending'. Use
the update result to detect when no pending row was changed and return the
appropriate existing not-found or no-op response, preventing accepted or
declined requests from transitioning again.
- Around line 7057-7090: Update the legacy message-history fallback around the
query and row-processing logic to persist or otherwise expose each record’s
thread identifier as a queryable legacy_records column, then filter by the
requested thread_id in SQL before decrypting rows. Remove the
sender/receiver-only fallback that can mix messages from other threads, combine
the equivalent is_match conditions, and replace the per-row blind exception
suppression with explicit handling that preserves the existing outer
missing-table behavior while surfacing decryption or parsing failures.