chore(comments): drop epic, sprint and review-round ids from the code

The code cited its plan instead of saying why: `E28 review J4`, `(R6 S3b)`, `S1 justified…`,
`deep-review round 5`. That plan lives in the private ops repo, so for every reader of this one the
citation was noise, and a sentence whose subject was the plan step ("round 2 showed…") hid its
lesson behind an id. Each one is gone and the "why" kept: a bare citation is deleted, a sentence
carrying a lesson is reworded around it ("a later attempt showed…").

Measured (`scripts/audit_metrics.py`, product code): 652 lines in 270 files carried an epic code by
the definition the next commit holds (507 / 241 by the old, two-digit-only one) -> 0. Across all
code, tests, scripts and configs: ~1100 epic-code lines plus ~320 sprint/round ids.

Behaviour unchanged, checked mechanically: every changed .py file has the same AST once docstrings
are blanked; css/sh/toml/yml/json files are identical once comments are stripped; the only
non-comment changes in TS/JS are test titles, one description string in a contract table, and five
ESLint messages, whose text is all the gates snapshot diff holds. Not touched: Markdown (docs and
the changelog keep their history), Alembic migrations, TV episode notation (`S2 · E5`), DESIGN.md
ids (`C1`, `B4`, `S3h`), tracker ids (`SEC-16`, `DX-17`).

One stale claim fixed on the way: test_hls_reaper's docstring said the player checkpoints "every
10 s whether or not it is playing", which plex/stream.py calls wrong; it now says what the code does.

frontend/src/components/Welcome.tsx

@@ -258,28 +258,28 @@ function Preview({
 // (aspect ratio preserved via object-contain). Closes on backdrop click, the ✕, or Escape.
 function Lightbox({ src, label, onClose }: { src: string; label: string; onClose: () => void }) {
   const { t } = useTranslation();
-  // An `aria-modal` shell that round 5's focus extraction did not sweep in: it declared itself a
+  // An `aria-modal` shell that the focus extraction did not sweep in: it declared itself a
   // modal dialog while leaving focus on the thumbnail behind an 80%-black scrim, announcing nothing,
   // and letting Tab walk the landing page underneath — the ✕ reachable only after tabbing past every
-  // remaining gallery shot (deep-review round 6). The contract comes from the same place `ui/Modal`
-  // and the wizard get theirs; the body-scroll lock moved with it, and round 7 added the layer
+  // remaining gallery shot. The contract comes from the same place `ui/Modal`
+  // and the wizard get theirs; the body-scroll lock moved with it, and a later fix added the layer
   // membership below.
   //
   // It was the third of four `aria-modal` shells to get the contract; `PlayerModal`, the fourth,
-  // joined in E11 S2, so all four (`ui/Modal`, the wizard, this, the player) now share
+  // joined last, so all four (`ui/Modal`, the wizard, this, the player) now share
   // `useDialogChrome` and its one counted scroll lock.
   const panelRef = useRef<HTMLDivElement>(null);
   useDialogChrome(panelRef);
   // An effect event, so the stack id is assigned once per mount (as in ui/Modal).
   const close = useEffectEvent(onClose);
   useEffect(() => {
-    // Round 6 gave this shell the trap and the restore but not the LAYER MEMBERSHIP the other three
+    // One fix gave this shell the trap and the restore but not the LAYER MEMBERSHIP the other three
     // have, so its Escape and Tab fired from a raw window listener whatever was on top of it. That
     // is the shape the wizard's own comment records being bitten by — "one Esc closed the error AND
     // ended onboarding" — and it is unreachable today only because `App` returns `<Welcome/>` before
     // it mounts `ErrorDialog` and the Toaster, i.e. by an ordering nothing enforces. Joining the
     // stack costs two lines and removes the trap-fights-trap failure mode from the next layer the
-    // landing page grows (deep-review round 7).
+    // landing page grows.
     const id = pushLayer();
     const onKey = (e: KeyboardEvent) => {
       if (takeEscape(e, id)) {
@@ -402,8 +402,8 @@ function AuthCard({ verify }: { verify: VerifyEntry }) {
       .catch(() => {});
   }, []);
   const [done, setDone] = useState<string>(""); // success/info message replacing the form
-  // Why password sign-in refused, when the server named a state worth a screen rather than a red line
-  // (E9.5 S4). It REPLACES the form: in all three of those states the password was already proven
+  // Why password sign-in refused, when the server named a state worth a screen rather than a red line.
+  // It REPLACES the form: in all three of those states the password was already proven
   // correct, so there is nothing to retype — leaving the form up would only invite a pointless retry.
   const [blocked, setBlocked] = useState<LoginBlocked | null>(null);
   // The emailed reset link turned out to be spent, expired, or to belong to an account that no longer
@@ -665,7 +665,7 @@ function AuthCard({ verify }: { verify: VerifyEntry }) {
             </Button>
           </form>
 
-          {/* A confirmation mail can be slow, filtered, or — before E9.5 S6 — never sent at all for a
+          {/* A confirmation mail can be slow, filtered, or — in older builds — never sent at all for a
               repeat sign-up. Offered right under the form rather than below the mode switches: it is
               the second thing a stuck person needs, after the password they just tried. */}
           {mode === "signin" && (
@@ -800,7 +800,7 @@ function StatePanel({
   );
 }
 
-// The named state behind a 403, in place of the sign-in form (E9.5 S4). It says WHICH mailbox the
+// The named state behind a 403, in place of the sign-in form. It says WHICH mailbox the
 // account is on and WHICH of the two gates is still shut, because the flat "awaiting admin approval"
 // string it replaces was true and useless: it never revealed that the address the account carried was
 // a different spelling of the one the user had just typed.