chore(comments): drop epic, sprint and review-round ids from the code

The code cited its plan instead of saying why: `E28 review J4`, `(R6 S3b)`, `S1 justified…`,
`deep-review round 5`. That plan lives in the private ops repo, so for every reader of this one the
citation was noise, and a sentence whose subject was the plan step ("round 2 showed…") hid its
lesson behind an id. Each one is gone and the "why" kept: a bare citation is deleted, a sentence
carrying a lesson is reworded around it ("a later attempt showed…").

Measured (`scripts/audit_metrics.py`, product code): 652 lines in 270 files carried an epic code by
the definition the next commit holds (507 / 241 by the old, two-digit-only one) -> 0. Across all
code, tests, scripts and configs: ~1100 epic-code lines plus ~320 sprint/round ids.

Behaviour unchanged, checked mechanically: every changed .py file has the same AST once docstrings
are blanked; css/sh/toml/yml/json files are identical once comments are stripped; the only
non-comment changes in TS/JS are test titles, one description string in a contract table, and five
ESLint messages, whose text is all the gates snapshot diff holds. Not touched: Markdown (docs and
the changelog keep their history), Alembic migrations, TV episode notation (`S2 · E5`), DESIGN.md
ids (`C1`, `B4`, `S3h`), tracker ids (`SEC-16`, `DX-17`).

One stale claim fixed on the way: test_hls_reaper's docstring said the player checkpoints "every
10 s whether or not it is playing", which plex/stream.py calls wrong; it now says what the code does.

frontend/src/components/authCardStates.dom.test.tsx

@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 //
-// The honest states of the sign-in card (E9.5 S4). Two things are under test and they share a root:
+// The honest states of the sign-in card. Two things are under test and they share a root:
 // a screen that does not name the address it is talking about hides an alias mismatch. On 2026-09-03
 // a registration as `np.temu@gmail.com` met a Google claim of `nptemu@gmail.com` and every screen in
 // the funnel stayed silent about it.
@@ -19,7 +19,7 @@ const noVerify: VerifyEntry = {
 };
 
 // Every case re-imports the whole Welcome tree after a module reset. The FIRST import also transforms
-// it, which under the full suite's parallel load ran past the 5 s test timeout (E32 S2, gate flake).
+// it, which under the full suite's parallel load ran past the 5 s test timeout (a gate flake).
 // Transforms survive resetModules, so warming them once here leaves each case only the evaluation.
 beforeAll(async () => {
   await import("./Welcome");
@@ -121,7 +121,7 @@ describe("a refused sign-in becomes a named state", () => {
 
     await signIn("approved.first@example.com");
 
-    // E9.5 S1 made the two gates order-independent; a screen that assumed a sequence would send this
+    // The two gates are order-independent; a screen that assumed a sequence would send this
     // user off to wait for an admin who has already decided.
     expect(screen.getByText("welcome.auth.blocked.gate.emailPending")).toBeTruthy();
     expect(screen.getByText("welcome.auth.blocked.gate.approvalDone")).toBeTruthy();