chore(comments): drop epic, sprint and review-round ids from the code

The code cited its plan instead of saying why: `E28 review J4`, `(R6 S3b)`, `S1 justified…`,
`deep-review round 5`. That plan lives in the private ops repo, so for every reader of this one the
citation was noise, and a sentence whose subject was the plan step ("round 2 showed…") hid its
lesson behind an id. Each one is gone and the "why" kept: a bare citation is deleted, a sentence
carrying a lesson is reworded around it ("a later attempt showed…").

Measured (`scripts/audit_metrics.py`, product code): 652 lines in 270 files carried an epic code by
the definition the next commit holds (507 / 241 by the old, two-digit-only one) -> 0. Across all
code, tests, scripts and configs: ~1100 epic-code lines plus ~320 sprint/round ids.

Behaviour unchanged, checked mechanically: every changed .py file has the same AST once docstrings
are blanked; css/sh/toml/yml/json files are identical once comments are stripped; the only
non-comment changes in TS/JS are test titles, one description string in a contract table, and five
ESLint messages, whose text is all the gates snapshot diff holds. Not touched: Markdown (docs and
the changelog keep their history), Alembic migrations, TV episode notation (`S2 · E5`), DESIGN.md
ids (`C1`, `B4`, `S3h`), tracker ids (`SEC-16`, `DX-17`).

One stale claim fixed on the way: test_hls_reaper's docstring said the player checkpoints "every
10 s whether or not it is playing", which plex/stream.py calls wrong; it now says what the code does.

backend/tests/test_auth_session.py

@@ -168,17 +168,17 @@ def test_reset_confirm_is_single_use_and_kills_existing_sessions(client, make_us
 
 
 def test_approving_an_unverified_account_keeps_its_password(db, make_user):
-    # E9.5 S1, inverting an earlier rule. Approval used to drop a password set while the email was
+    # This inverts an earlier rule. Approval used to drop a password set while the email was
     # unverified (SEC-10, account pre-emption). It was dropped because it destroyed the password a
     # legitimate registrant had just chosen, in what is the NORMAL ordering — the admin decides
     # before the user reads their mail — making "your password was cleared for security" the default
     # experience.
     #
-    # S1 ALSO argued the revoke was redundant, because password_login refuses an unverified account
-    # before it reads is_active. The epic's closing review refuted that: the gate holds only while
-    # the address is unverified, and S6's approval mail exists to get the real owner to end that
-    # state. Do not restore that reasoning from this comment — the residual is SEC-16, and round 2
-    # of the review tried and reverted a guard for it (see test_review_round.py).
+    # It was ALSO argued that the revoke was redundant, because password_login refuses an
+    # unverified account before it reads is_active. The epic's closing review refuted that: the gate
+    # holds only while the address is unverified, and the approval mail exists to get the real
+    # owner to end that state. Do not restore that reasoning from this comment — the residual is
+    # SEC-16, and the same review tried and reverted a guard for it (see test_review_round.py).
     from app.routes.admin import _activate_user_by_email
 
     user = make_user(
@@ -245,7 +245,7 @@ def test_verifying_afterwards_lets_the_original_password_in(client, db, make_use
 
 def test_activating_a_verified_account_keeps_its_password(db, make_user):
     # The no-SMTP shape: registration marks such an account verified up front, so it was never in
-    # scope for the SEC-10 guard even before E9.5 S1. Kept as the other half of the pair.
+    # scope for the SEC-10 guard even back then. Kept as the other half of the pair.
     from app.routes.admin import _activate_user_by_email
 
     user = make_user(
@@ -354,7 +354,7 @@ def test_an_admin_can_activate_a_pre_approved_registrant(db, monkeypatch):
 
     db.expire_all()
     assert user.is_active is True
-    assert user.password_hash is not None  # approval never touches the password (E9.5 S1)
+    assert user.password_hash is not None  # approval never touches the password
 
 
 def test_registration_of_an_unknown_email_still_persists_account_and_pending_invite(
@@ -483,7 +483,7 @@ def test_register_route_is_refused_when_registration_is_closed(client, db, monke
 # was a deliberately uniform "ok"/401. `password_revoked_at` is the trace that tells the two apart;
 # these pin each step of the way back in.
 #
-# E9.5 S1 removed the admin-approval caller, so Google adoption is the only path that still produces
+# The admin-approval caller is gone, so Google adoption is the only path that still produces
 # this state — plus every account stripped on prod before that change, which is why the whole recovery
 # route below must keep working. These tests manufacture the state through the surviving producer.