chore(comments): drop epic, sprint and review-round ids from the code

The code cited its plan instead of saying why: `E28 review J4`, `(R6 S3b)`, `S1 justified…`,
`deep-review round 5`. That plan lives in the private ops repo, so for every reader of this one the
citation was noise, and a sentence whose subject was the plan step ("round 2 showed…") hid its
lesson behind an id. Each one is gone and the "why" kept: a bare citation is deleted, a sentence
carrying a lesson is reworded around it ("a later attempt showed…").

Measured (`scripts/audit_metrics.py`, product code): 652 lines in 270 files carried an epic code by
the definition the next commit holds (507 / 241 by the old, two-digit-only one) -> 0. Across all
code, tests, scripts and configs: ~1100 epic-code lines plus ~320 sprint/round ids.

Behaviour unchanged, checked mechanically: every changed .py file has the same AST once docstrings
are blanked; css/sh/toml/yml/json files are identical once comments are stripped; the only
non-comment changes in TS/JS are test titles, one description string in a contract table, and five
ESLint messages, whose text is all the gates snapshot diff holds. Not touched: Markdown (docs and
the changelog keep their history), Alembic migrations, TV episode notation (`S2 · E5`), DESIGN.md
ids (`C1`, `B4`, `S3h`), tracker ids (`SEC-16`, `DX-17`).

One stale claim fixed on the way: test_hls_reaper's docstring said the player checkpoints "every
10 s whether or not it is playing", which plex/stream.py calls wrong; it now says what the code does.

backend/tests/test_upload.py

@@ -1,4 +1,4 @@
-"""E7 S5a — local file upload ingest (the non-yt-dlp path into the media library).
+"""Local file upload ingest (the non-yt-dlp path into the media library).
 
 Covers the ingest spine: media vs generic-file classification, the download-only serving of a
 generic file (force-download so uploaded HTML/SVG can't execute inline), quota accounting with the
@@ -131,7 +131,7 @@ def test_ingest_rejects_over_footprint_cap_before_writing(db, make_user, _root,
     assert db.query(MediaAsset).count() == 0  # and no orphan asset row
 
 
-# --- route: the auth-first body (P1) --------------------------------------------------------
+# --- route: the auth-first body ------------------------------------------------------------
 
 
 def _counting_body(chunks: int = 4, size: int = 1024):
@@ -183,7 +183,7 @@ def _counting_multipart(chunks: int = 4, size: int = 1024):
 
 
 def test_an_anonymous_upload_is_refused_before_a_byte_of_it_is_read(client):
-    """P1 — the defect E27 bounded but did not close.
+    """The defect an earlier fix bounded but did not close.
 
     While the route declared `file: UploadFile = File(...)`, FastAPI parsed and spooled the body
     BEFORE the first dependency ran, so the auth dependency could not gate it: an unauthenticated
@@ -433,7 +433,7 @@ def test_a_long_display_name_is_truncated_on_EVERY_route_that_takes_one(
     this varchar(255) column; `POST /api/downloads` and `POST /api/downloads/edit` kept the old
     `(x or "").strip() or None` and would still have answered a bare 500 (a psycopg DataError,
     which main.py re-raises for everything but the NUL case) to a name a user simply pasted. Found
-    by four independent readers in deep-review round 2 — a sweep is exactly the kind of thing that
+    by four independent readers of one review — a sweep is exactly the kind of thing that
     gets done four-fifths of the way, so this holds all of it at once.
     """
     _probe(monkeypatch, ("h264", "aac", 640, 480, 60))
@@ -487,7 +487,7 @@ def _display_write_sites() -> dict[tuple[str, str], set[str]]:
     TWO SHAPES, because the first version of this guard walked only `ast.Assign` and was therefore
     blind to the shape the upload route itself uses — `SpooledUpload(..., display_name=...)` is an
     `ast.keyword`, not an assignment, so the one site with an unbounded REQUEST HEADER behind it was
-    the site the guard could not see (deep-review round 3).
+    the site the guard could not see.
 
     ANNOTATED assignments are excluded on purpose: `display_name: Mapped[str | None] =
     mapped_column(...)` in `models.py` and `display_name: str | None = None` in a Pydantic model are
@@ -540,7 +540,7 @@ def _display_write_sites() -> dict[tuple[str, str], set[str]]:
 #
 # Held as EXACT EQUALITY rather than as a list of offenders. The offender form could only fail
 # upward: refactoring the writers into a shape the walker did not recognise left it asserting
-# `not []` and enforcing nothing, which is how a drift guard dies quietly (round 3). This one fails
+# `not []` and enforcing nothing, which is how a drift guard dies quietly. This one fails
 # when a site appears, when one disappears, and when one changes what it writes.
 DISPLAY_WRITE_SITES = {
     ("downloads/service.py", "redownload"): {"None"},
@@ -678,7 +678,7 @@ def test_the_usage_route_reports_the_per_file_upload_cap(as_user, make_user, db)
     """The dialog refuses an over-cap file off this number, and it is the only layer that produces
     a refusal carrying the limit on a default install — so the field is load-bearing, not
     decorative. Nothing held it: the route had no test at all, and the frontend's `DownloadUsage`
-    is an unvalidated cast, so dropping the key would have been green everywhere (round 2).
+    is an unvalidated cast, so dropping the key would have been green everywhere.
     """
     from app import sysconfig
 
@@ -914,7 +914,7 @@ class TestResolveMediaFacts:
         assert mediakind.derive(v, a) == mediakind.VIDEO  # NOT 'file'
 
     def test_the_duration_comes_from_the_file_when_info_has_none(self, monkeypatch):
-        # Facebook reel 257 (E11.5): yt-dlp gave no duration, the file is 128.4 s. A NULL duration hid
+        # Facebook reel 257: yt-dlp gave no duration, the file is 128.4 s. A NULL duration hid
         # the Library row's trim action.
         self._ffprobe(
             monkeypatch,