chore(comments): drop epic, sprint and review-round ids from the code

The code cited its plan instead of saying why: `E28 review J4`, `(R6 S3b)`, `S1 justified…`,
`deep-review round 5`. That plan lives in the private ops repo, so for every reader of this one the
citation was noise, and a sentence whose subject was the plan step ("round 2 showed…") hid its
lesson behind an id. Each one is gone and the "why" kept: a bare citation is deleted, a sentence
carrying a lesson is reworded around it ("a later attempt showed…").

Measured (`scripts/audit_metrics.py`, product code): 652 lines in 270 files carried an epic code by
the definition the next commit holds (507 / 241 by the old, two-digit-only one) -> 0. Across all
code, tests, scripts and configs: ~1100 epic-code lines plus ~320 sprint/round ids.

Behaviour unchanged, checked mechanically: every changed .py file has the same AST once docstrings
are blanked; css/sh/toml/yml/json files are identical once comments are stripped; the only
non-comment changes in TS/JS are test titles, one description string in a contract table, and five
ESLint messages, whose text is all the gates snapshot diff holds. Not touched: Markdown (docs and
the changelog keep their history), Alembic migrations, TV episode notation (`S2 · E5`), DESIGN.md
ids (`C1`, `B4`, `S3h`), tracker ids (`SEC-16`, `DX-17`).

One stale claim fixed on the way: test_hls_reaper's docstring said the player checkpoints "every
10 s whether or not it is playing", which plex/stream.py calls wrong; it now says what the code does.

frontend/src/components/AdminUsers.tsx

@@ -113,7 +113,7 @@ function UsersRoles({ me }: { me: Me }) {
   // Which rows have an action in flight, so we disable ONLY those rows' buttons (SC1) — a Set, since
   // with per-row disabling the admin can now start actions on several rows concurrently.
   const [pendingIds, setPendingIds] = useState<Set<number>>(new Set());
-  // The account panel (E12 S5): which user it is showing, or null. Held here rather than per row so
+  // The account panel: which user it is showing, or null. Held here rather than per row so
   // only one is ever mounted.
   const [panelFor, setPanelFor] = useState<AdminUserRow | null>(null);
   const startPending = (id: number) => setPendingIds((s) => new Set(s).add(id));
@@ -208,7 +208,7 @@ function UsersRoles({ me }: { me: Me }) {
     if (ok) del.mutate({ id: u.id, email: u.email });
   };
 
-  // The row's actions are ONE menu (DESIGN § Action placement, E31): the role, the suspension and
+  // The row's actions are ONE menu (DESIGN § Action placement): the role, the suspension and
   // the delete — rare and two of them destructive — open from the row's "…", a right-click on the row,
   // a long-press or Shift+F10. The row keeps what the admin reads: the name, the role and state
   // badges, the last sign-in. A locked action (on yourself) stays listed with its reason.
@@ -273,7 +273,7 @@ function UsersRoles({ me }: { me: Me }) {
           {rows.map((u) => {
             const self = u.id === me.id;
             return (
-              // The whole card is the row, so the whole card answers (owner, E28): the name's button
+              // The whole card is the row, so the whole card answers (owner's call): the name's button
               // stretches an invisible layer over the card (`after:inset-0`), so a click on a badge or
               // a gap opens the account too, and the B3 hover layer is the card's own `::before`, under
               // the badges and buttons (`isolate` + `z-under`). The actions are `relative`, above the