chore(comments): drop epic, sprint and review-round ids from the code

The code cited its plan instead of saying why: `E28 review J4`, `(R6 S3b)`, `S1 justified…`,
`deep-review round 5`. That plan lives in the private ops repo, so for every reader of this one the
citation was noise, and a sentence whose subject was the plan step ("round 2 showed…") hid its
lesson behind an id. Each one is gone and the "why" kept: a bare citation is deleted, a sentence
carrying a lesson is reworded around it ("a later attempt showed…").

Measured (`scripts/audit_metrics.py`, product code): 652 lines in 270 files carried an epic code by
the definition the next commit holds (507 / 241 by the old, two-digit-only one) -> 0. Across all
code, tests, scripts and configs: ~1100 epic-code lines plus ~320 sprint/round ids.

Behaviour unchanged, checked mechanically: every changed .py file has the same AST once docstrings
are blanked; css/sh/toml/yml/json files are identical once comments are stripped; the only
non-comment changes in TS/JS are test titles, one description string in a contract table, and five
ESLint messages, whose text is all the gates snapshot diff holds. Not touched: Markdown (docs and
the changelog keep their history), Alembic migrations, TV episode notation (`S2 · E5`), DESIGN.md
ids (`C1`, `B4`, `S3h`), tracker ids (`SEC-16`, `DX-17`).

One stale claim fixed on the way: test_hls_reaper's docstring said the player checkpoints "every
10 s whether or not it is playing", which plex/stream.py calls wrong; it now says what the code does.

backend/tests/test_review_round.py

@@ -1,10 +1,10 @@
-"""E9.5 review round — the invariants the epic's own review found unpinned.
+"""Review round — the invariants the canonical-email work's own review found unpinned.
 
 Every test here corresponds to a defect a reviewer could still introduce with the whole suite green:
 a mail whose body never renders in any test, an activation that only works for the exact spelling, a
 "we already wrote to them" stamp for a mail that was dropped, an env allow-list that answers a
-different question than the gate it backs, and the address pre-emption that E9.5 S1's argument
-covered only while the address stayed unverified.
+different question than the gate it backs, and the address pre-emption that the order-independent
+gates' argument covered only while the address stayed unverified.
 """
 
 from datetime import datetime, timedelta, timezone
@@ -79,7 +79,7 @@ def test_every_mail_renders_in_every_language(wire, name, args, lang):
 
 
 def test_a_weeks_link_is_described_in_days_not_hours(wire):
-    # The S6 approval token lives seven days, and the mail used to say "expires in 168 hours".
+    # The approval token lives seven days, and the mail used to say "expires in 168 hours".
     email_mod.send_access_approved("to@example.com", "en", "https://x/#verify=t", True, 168)
     assert "7 days" in wire[0][2] and "168" not in wire[0][2]
 
@@ -91,7 +91,7 @@ def test_a_weeks_link_is_described_in_days_not_hours(wire):
 
 
 def test_a_later_registration_never_touches_an_existing_password(db, client, smtp_on, wire):
-    """The rule E9.5's review round 2 put back, having tried the opposite and found it worse.
+    """The rule a review put back, having tried the opposite and found it worse.
 
     "While the address is unverified, the newest registration owns it" looked like a fix for address
     pre-emption. It is symmetric — an attacker can always be last — so it closed nothing, and it