chore(comments): drop epic, sprint and review-round ids from the code

The code cited its plan instead of saying why: `E28 review J4`, `(R6 S3b)`, `S1 justified…`,
`deep-review round 5`. That plan lives in the private ops repo, so for every reader of this one the
citation was noise, and a sentence whose subject was the plan step ("round 2 showed…") hid its
lesson behind an id. Each one is gone and the "why" kept: a bare citation is deleted, a sentence
carrying a lesson is reworded around it ("a later attempt showed…").

Measured (`scripts/audit_metrics.py`, product code): 652 lines in 270 files carried an epic code by
the definition the next commit holds (507 / 241 by the old, two-digit-only one) -> 0. Across all
code, tests, scripts and configs: ~1100 epic-code lines plus ~320 sprint/round ids.

Behaviour unchanged, checked mechanically: every changed .py file has the same AST once docstrings
are blanked; css/sh/toml/yml/json files are identical once comments are stripped; the only
non-comment changes in TS/JS are test titles, one description string in a contract table, and five
ESLint messages, whose text is all the gates snapshot diff holds. Not touched: Markdown (docs and
the changelog keep their history), Alembic migrations, TV episode notation (`S2 · E5`), DESIGN.md
ids (`C1`, `B4`, `S3h`), tracker ids (`SEC-16`, `DX-17`).

One stale claim fixed on the way: test_hls_reaper's docstring said the player checkpoints "every
10 s whether or not it is playing", which plex/stream.py calls wrong; it now says what the code does.

backend/tests/test_abuse_limits.py

@@ -1,4 +1,4 @@
-"""E12 · S3 — the route-level halves of SEC-12 and SEC-14.
+"""The route-level halves of SEC-12 and SEC-14.
 
 `test_urlguard.py` pins the address judgement itself; this pins that the ENQUEUE route actually
 consults it and answers in the structured `{code, reason}` shape the frontend localizes, and that a
@@ -38,7 +38,7 @@ def test_a_public_url_gets_past_the_guard(db, as_user, make_user, monkeypatch):
     )
     # An inline spec, so nothing ELSE refuses it: without one the request stopped at the
     # profile lookup (400 no_profile) and "not url_blocked" held for a request the guard never
-    # had to wave through (E32 S2).
+    # had to wave through.
     r = as_user(user).post(
         "/api/downloads", json={"source": "https://example.com/v", "spec": {"format": "best"}}
     )
@@ -56,7 +56,7 @@ def test_youtube_sources_never_consult_the_guard(db, as_user, make_user, monkeyp
     db.commit()
     monkeypatch.setattr(urlguard.socket, "getaddrinfo", boom)
     # The job must actually be created: a request refused for any other reason would never reach
-    # the guard either, and the test would pass without proving anything (E32 S2).
+    # the guard either, and the test would pass without proving anything.
     r = as_user(user).post(
         "/api/downloads", json={"source": "dQw4w9WgXcQ", "spec": {"format": "best"}}
     )