chore(comments): drop epic, sprint and review-round ids from the code

The code cited its plan instead of saying why: `E28 review J4`, `(R6 S3b)`, `S1 justified…`,
`deep-review round 5`. That plan lives in the private ops repo, so for every reader of this one the
citation was noise, and a sentence whose subject was the plan step ("round 2 showed…") hid its
lesson behind an id. Each one is gone and the "why" kept: a bare citation is deleted, a sentence
carrying a lesson is reworded around it ("a later attempt showed…").

Measured (`scripts/audit_metrics.py`, product code): 652 lines in 270 files carried an epic code by
the definition the next commit holds (507 / 241 by the old, two-digit-only one) -> 0. Across all
code, tests, scripts and configs: ~1100 epic-code lines plus ~320 sprint/round ids.

Behaviour unchanged, checked mechanically: every changed .py file has the same AST once docstrings
are blanked; css/sh/toml/yml/json files are identical once comments are stripped; the only
non-comment changes in TS/JS are test titles, one description string in a contract table, and five
ESLint messages, whose text is all the gates snapshot diff holds. Not touched: Markdown (docs and
the changelog keep their history), Alembic migrations, TV episode notation (`S2 · E5`), DESIGN.md
ids (`C1`, `B4`, `S3h`), tracker ids (`SEC-16`, `DX-17`).

One stale claim fixed on the way: test_hls_reaper's docstring said the player checkpoints "every
10 s whether or not it is playing", which plex/stream.py calls wrong; it now says what the code does.

backend/app/bodylimit.py

@@ -59,7 +59,7 @@ DEFAULT_MAX_BODY_BYTES = 1024 * 1024
 # a say.
 #
 # Both listed routes now satisfy that. The screenshot route always did (`capped_body` streams it,
-# and the owner check resolves first). The upload route did NOT until P1: it declared
+# and the owner check resolves first). The upload route did NOT at first: it declared
 # `file: UploadFile = File(...)`, so an anonymous caller could make the process write the whole
 # per-file allowance to temp before the auth dependency refused them — this middleware bounded that
 # number but could not stop the writing. It now reads its own body from a dependency declared after
@@ -73,12 +73,12 @@ DEFAULT_MAX_BODY_BYTES = 1024 * 1024
 # `POST /api/diagnostics/events` is absent: its `capped_body` limit is 512 KiB, already below the
 # default, so listing it could only widen what it accepts.
 ROUTE_MAX_BODY_BYTES: dict[tuple[str, str], int] = {
-    # Ingesting a local file. The body IS the file since P1 — no multipart envelope to allow for —
+    # Ingesting a local file. The body IS the file now — no multipart envelope to allow for —
     # so this ceiling and the route's own cap count exactly the same bytes. `sysconfig`'s
     # `download_upload_max_bytes` is bounded by this same constant (see sysconfig.SPECS), so an
     # admin can only ever LOWER the route's cap below the edge, never raise it past one.
     #
-    # WHICH LAYER ANSWERS, measured rather than assumed (deep-review round 1):
+    # WHICH LAYER ANSWERS, measured rather than assumed:
     #   * knob LOWERED (an override below the default) — the route's cap is the smaller number, so
     #     `capped_stream_to` trips first and answers 422 `upload_too_large` carrying the admin's own
     #     figure, after draining the rest of the body so the client can read it.