chore(comments): drop epic, sprint and review-round ids from the code

The code cited its plan instead of saying why: `E28 review J4`, `(R6 S3b)`, `S1 justified…`,
`deep-review round 5`. That plan lives in the private ops repo, so for every reader of this one the
citation was noise, and a sentence whose subject was the plan step ("round 2 showed…") hid its
lesson behind an id. Each one is gone and the "why" kept: a bare citation is deleted, a sentence
carrying a lesson is reworded around it ("a later attempt showed…").

Measured (`scripts/audit_metrics.py`, product code): 652 lines in 270 files carried an epic code by
the definition the next commit holds (507 / 241 by the old, two-digit-only one) -> 0. Across all
code, tests, scripts and configs: ~1100 epic-code lines plus ~320 sprint/round ids.

Behaviour unchanged, checked mechanically: every changed .py file has the same AST once docstrings
are blanked; css/sh/toml/yml/json files are identical once comments are stripped; the only
non-comment changes in TS/JS are test titles, one description string in a contract table, and five
ESLint messages, whose text is all the gates snapshot diff holds. Not touched: Markdown (docs and
the changelog keep their history), Alembic migrations, TV episode notation (`S2 · E5`), DESIGN.md
ids (`C1`, `B4`, `S3h`), tracker ids (`SEC-16`, `DX-17`).

One stale claim fixed on the way: test_hls_reaper's docstring said the player checkpoints "every
10 s whether or not it is playing", which plex/stream.py calls wrong; it now says what the code does.

backend/tests/test_login_states.py

@@ -1,10 +1,10 @@
-"""What a refused sign-in SAYS (E9.5 S4), DB-lane.
+"""What a refused sign-in SAYS, DB-lane.
 
 The states behind a 403 were true and useless: "Your account is awaiting admin approval." never
 revealed WHICH mailbox the account was on. On 2026-09-03 a registration as `npeter83.temu@gmail.com`
 met a Google claim of `npeter83temu@gmail.com`, and that missing address hid the mismatch for a day.
-So these pin the DETAIL, not just the status code — the address, and both gates, since E9.5 S1 made
-the two order-independent and the screen must report whichever is actually outstanding.
+So these pin the DETAIL, not just the status code — the address, and both gates, since the two are
+order-independent and the screen must report whichever is actually outstanding.
 
 The two refusals that answer BEFORE the password is proven carry nothing, and that is the security
 half of the same contract: `invalid` must stay byte-identical for a real account and an unknown one.
@@ -34,7 +34,7 @@ def test_pending_approval_names_the_address_the_account_is_on(client, make_user)
 
 
 def test_an_already_approved_account_still_reports_its_missing_verification(client, make_user):
-    # S1 made the gates order-independent, so this really happens: approved, not yet verified. A
+    # The gates are order-independent, so this really happens: approved, not yet verified. A
     # screen that assumed a sequence would tell this user to wait for an admin who already decided.
     make_user(
         email="approved.first@example.com", password=_PW, email_verified=False, is_active=True