chore(comments): drop epic, sprint and review-round ids from the code

The code cited its plan instead of saying why: `E28 review J4`, `(R6 S3b)`, `S1 justified…`,
`deep-review round 5`. That plan lives in the private ops repo, so for every reader of this one the
citation was noise, and a sentence whose subject was the plan step ("round 2 showed…") hid its
lesson behind an id. Each one is gone and the "why" kept: a bare citation is deleted, a sentence
carrying a lesson is reworded around it ("a later attempt showed…").

Measured (`scripts/audit_metrics.py`, product code): 652 lines in 270 files carried an epic code by
the definition the next commit holds (507 / 241 by the old, two-digit-only one) -> 0. Across all
code, tests, scripts and configs: ~1100 epic-code lines plus ~320 sprint/round ids.

Behaviour unchanged, checked mechanically: every changed .py file has the same AST once docstrings
are blanked; css/sh/toml/yml/json files are identical once comments are stripped; the only
non-comment changes in TS/JS are test titles, one description string in a contract table, and five
ESLint messages, whose text is all the gates snapshot diff holds. Not touched: Markdown (docs and
the changelog keep their history), Alembic migrations, TV episode notation (`S2 · E5`), DESIGN.md
ids (`C1`, `B4`, `S3h`), tracker ids (`SEC-16`, `DX-17`).

One stale claim fixed on the way: test_hls_reaper's docstring said the player checkpoints "every
10 s whether or not it is playing", which plex/stream.py calls wrong; it now says what the code does.

backend/tests/test_facebook_impersonation.py

@@ -1,13 +1,13 @@
-"""E11.5 S3 + S4 — the Facebook download path with the user's cookie.
+"""The Facebook download path with the user's cookie.
 
-S3, measured on dev (yt-dlp 2026.07.04, the owner's cookie): reel 806379462330494 fails with the cookie
+Measured on dev (yt-dlp 2026.07.04, the owner's cookie): reel 806379462330494 fails with the cookie
 alone and extracts 2560p with `--impersonate chrome`; the reels that already download with the cookie
 keep their plain first attempt. These pin the attempt order through the real download loop
 (`pipeline._extract_with_fallback`, with yt-dlp faked at the `YoutubeDL` boundary), and that the
 LOCKED curl_cffi can actually impersonate — the pair only works inside yt-dlp's own version range, and
 outside it every target silently reports "unavailable".
 
-S4, measured on dev and in the owner's Chrome: given a group post's link, yt-dlp finds no formats or
+Measured on dev and in the owner's Chrome: given a group post's link, yt-dlp finds no formats or
 downloads another video from the page's feed. The post's own video is the single Video node in the
 page scripts that carry the post id (prod posts 66, 145, 140, 143, 221; text posts have none while the
 page holds ~10 other videos), and its watch link downloads.
@@ -139,7 +139,7 @@ def test_other_facebook_failures_are_not_retried_as_chrome(ydl, tmp_path):
     assert len(seen) == 1 and "impersonate" not in seen[0]
 
 
-# --- S4: a group post downloads ITS video, or fails saying it has none ----------------------------
+# --- a group post downloads ITS video, or fails saying it has none --------------------------------
 
 
 def test_a_cookie_group_post_downloads_the_posts_own_video(ydl, tmp_path):
@@ -174,7 +174,7 @@ def test_a_group_post_without_a_single_video_fails_saying_so(ydl, tmp_path):
 
 
 def test_a_group_post_page_without_the_post_is_the_refused_cookie(ydl, tmp_path):
-    # Measured with a refused cookie (E11.5 review): Facebook answers the post link with its login page —
+    # Measured with a refused cookie: Facebook answers the post link with its login page —
     # a login form, no post id anywhere. Saying "this post has no video" would blame the post.
     _, _, web = ydl
     web["page"] = '<html><title>ChatGPT magyarul</title><form id="login_form"></form></html>'