chore(comments): drop epic, sprint and review-round ids from the code

The code cited its plan instead of saying why: `E28 review J4`, `(R6 S3b)`, `S1 justified…`,
`deep-review round 5`. That plan lives in the private ops repo, so for every reader of this one the
citation was noise, and a sentence whose subject was the plan step ("round 2 showed…") hid its
lesson behind an id. Each one is gone and the "why" kept: a bare citation is deleted, a sentence
carrying a lesson is reworded around it ("a later attempt showed…").

Measured (`scripts/audit_metrics.py`, product code): 652 lines in 270 files carried an epic code by
the definition the next commit holds (507 / 241 by the old, two-digit-only one) -> 0. Across all
code, tests, scripts and configs: ~1100 epic-code lines plus ~320 sprint/round ids.

Behaviour unchanged, checked mechanically: every changed .py file has the same AST once docstrings
are blanked; css/sh/toml/yml/json files are identical once comments are stripped; the only
non-comment changes in TS/JS are test titles, one description string in a contract table, and five
ESLint messages, whose text is all the gates snapshot diff holds. Not touched: Markdown (docs and
the changelog keep their history), Alembic migrations, TV episode notation (`S2 · E5`), DESIGN.md
ids (`C1`, `B4`, `S3h`), tracker ids (`SEC-16`, `DX-17`).

One stale claim fixed on the way: test_hls_reaper's docstring said the player checkpoints "every
10 s whether or not it is playing", which plex/stream.py calls wrong; it now says what the code does.

backend/app/routes/diagnostics.py

@@ -1,4 +1,4 @@
-"""The browser's log, sent while its user has a raised diagnostics level (E22 S5).
+"""The browser's log, sent while its user has a raised diagnostics level.
 
 The client keeps its log in memory (frontend `lib/log.ts`). Only after the user consented to Részletes
 or Teljes in Settings → Diagnosztika does it stream that log here, in batches, and each batch lands in
@@ -14,7 +14,7 @@ Nothing from the body is trusted as-is:
     modified client would not;
   * an event below the consented level is dropped (a Részletes consent does not store what only
     Teljes may carry), and so is the whole batch once the level has lapsed — where an open debug
-    session the request names counts as consent to ITS level (E16), and only its own events keep
+    session the request names counts as consent to ITS level, and only its own events keep
     its tag;
   * the timestamp is clamped to the consent window, so a row cannot dodge the retention job by
     claiming to come from the future.
@@ -63,7 +63,7 @@ class ClientEvent(BaseModel):
     attrs: dict[str, Any] | None = None
     request_id: str | None = Field(default=None, pattern=r"^[A-Za-z0-9._-]{8,64}$")
     tab_id: str | None = Field(default=None, pattern=r"^[A-Za-z0-9_-]{1,32}$")
-    # The debug session the event was captured in (E16); kept only when it is the one this request
+    # The debug session the event was captured in; kept only when it is the one this request
     # names in `X-Debug-Session` and the auth dependency found it the caller's own and open.
     debug_session_id: str | None = Field(default=None, pattern=r"^[0-9a-f]{16}$")
     version: str | None = Field(default=None, max_length=64)
@@ -138,7 +138,7 @@ def ingest_events(
     body: ClientEventsIn = Depends(_parsed_events),
     db: Session = Depends(get_db),
 ) -> dict:
-    # A debug session the request names raises the level for its own events (E16): starting one is
+    # A debug session the request names raises the level for its own events: starting one is
     # the consent to that level for its duration, whatever the user's own level is.
     session = debugsession.from_header(db, user, request.headers.get(debugsession.HEADER))
     level, _ = debugsession.level_for(user, session)