fix(security): upgrade Django to 5.2.16

Author: victorsteele

CHANGELOG.md

@@ -14,6 +14,7 @@ All notable repository-level changes are recorded here. Application history befo
 - Changed deterministic source release archive branding to `mailstack-<version>-source.zip`.
 - Added a compatibility-safe repository bootstrap, first-commit guidance, and GitHub metadata/topics specification.
 - Removed the stale root `SOURCE_MANIFEST.sha256`; verified release archives continue to generate their own manifest.
+- Upgraded the pinned Django LTS runtime from 5.2.15 to 5.2.16 to resolve the July 2026 Django security advisories and kept exact-version deployment verification aligned.
 
 ### Compatibility
 

docs/DEPENDENCY_REVIEW.md

@@ -4,7 +4,7 @@
 
 | Package | Version | Primary license family | Purpose |
 |---|---:|---|---|
-| Django | 5.2.15 | BSD-3-Clause | Web framework |
+| Django | 5.2.16 | BSD-3-Clause | Web framework |
 | argon2-cffi | 25.1.0 | MIT | Password hashing support |
 | bleach | 6.4.0 | Apache-2.0 | HTML sanitization |
 | filelock | 3.20.3 | Unlicense | Cross-process locking |
@@ -21,4 +21,4 @@ No obvious conflict was identified between the declared direct dependency licens
 
 ## Vulnerability review
 
-`pip check` passes in the audit environment. The online advisory query could not complete because external DNS was unavailable; GitHub CI retains `pip-audit` as a blocking network-enabled gate.
+`pip check` passes in the audit environment. Django is pinned to 5.2.16, the upstream July 2026 security release for the 5.2 LTS line. GitHub CI retains `pip-audit` as a blocking network-enabled gate.

docs/FORENSIC_AUDIT_REPORT.md

@@ -38,7 +38,7 @@ The deterministic machine-readable inventory at `docs/FORENSIC_FILE_INVENTORY.js
 
 ## Architecture
 
-- Django 5.2.15 team mailbox application
+- Django 5.2.16 team mailbox application
 - Gunicorn application service over a Unix socket
 - MariaDB application schema and virtual-mail schema
 - receive-only Postfix virtual mailbox delivery