chore(comments): drop epic, sprint and review-round ids from the code

The code cited its plan instead of saying why: `E28 review J4`, `(R6 S3b)`, `S1 justified…`,
`deep-review round 5`. That plan lives in the private ops repo, so for every reader of this one the
citation was noise, and a sentence whose subject was the plan step ("round 2 showed…") hid its
lesson behind an id. Each one is gone and the "why" kept: a bare citation is deleted, a sentence
carrying a lesson is reworded around it ("a later attempt showed…").

Measured (`scripts/audit_metrics.py`, product code): 652 lines in 270 files carried an epic code by
the definition the next commit holds (507 / 241 by the old, two-digit-only one) -> 0. Across all
code, tests, scripts and configs: ~1100 epic-code lines plus ~320 sprint/round ids.

Behaviour unchanged, checked mechanically: every changed .py file has the same AST once docstrings
are blanked; css/sh/toml/yml/json files are identical once comments are stripped; the only
non-comment changes in TS/JS are test titles, one description string in a contract table, and five
ESLint messages, whose text is all the gates snapshot diff holds. Not touched: Markdown (docs and
the changelog keep their history), Alembic migrations, TV episode notation (`S2 · E5`), DESIGN.md
ids (`C1`, `B4`, `S3h`), tracker ids (`SEC-16`, `DX-17`).

One stale claim fixed on the way: test_hls_reaper's docstring said the player checkpoints "every
10 s whether or not it is playing", which plex/stream.py calls wrong; it now says what the code does.

frontend/src/lib/api/core.ts

@@ -13,7 +13,7 @@ import { currentDebugSession, newRequestId } from "../log";
 /** The active UI language, as a bare code the server understands ("en"/"hu" — never "en-GB").
  *  Lives here so the request builders can stamp it themselves: a signal that has to be passed in by
  *  every caller is one every caller can forget, which is how the registration language shipped as a
- *  field nobody ever filled (E9.5 S6 → S7). */
+ *  field nobody ever filled. */
 export const uiLang = (): string => i18n.language.split("-")[0] || "en";
 
 // Errors `req` has already put in front of the user for good — the blocking error dialog, or the
@@ -24,7 +24,7 @@ export const uiLang = (): string => i18n.language.split("-")[0] || "en";
 // NOT the connection notice. It says the server is unreachable, not that this action failed, and it
 // removes itself on the next answer — which every caller's own resync refetch fetches at once. Marked
 // as reported, a delete that hit a keepalive reset (a 502) flashed the notice for a moment and was
-// then reported nowhere at all, the list still there (deep-review round 4).
+// then reported nowhere at all, the list still there.
 //
 // A caller that reports a failure itself marks it too (`notifyActionError` does), which is what lets
 // the ONE app-wide mutation reporter (lib/queryClient) stay quiet for a mutation whose own `onError`
@@ -96,7 +96,7 @@ function localizeDetail(d: unknown): string {
     return t(`downloads.errors.edit.${o.reason}`, t("downloads.errors.edit.generic"));
   if (o?.code === "cookies")
     return t(`downloads.errors.cookies.${o.reason}`, t("downloads.errors.cookies.generic"));
-  // Password sign-in refusals (E9.5 S4). The card renders the account-shaped ones as a full panel
+  // Password sign-in refusals. The card renders the account-shaped ones as a full panel
   // off `detailData`; this is the one-line form every other consumer (and the card's own fallback)
   // gets. A reason this build doesn't know falls through to the generic message rather than showing
   // a raw key, which is what an i18n miss would otherwise put on screen.
@@ -109,7 +109,7 @@ function localizeDetail(d: unknown): string {
     return o.reason === "weak_password"
       ? t("welcome.auth.weakPassword", { min: o.limit ?? o.min })
       : t("welcome.auth.deadLink.short");
-  // Local-upload ingest (E7 S5): the per-file cap carries the limit in bytes; empty is a bare code.
+  // Local-upload ingest: the per-file cap carries the limit in bytes; empty is a bare code.
   if (o?.code === "upload_too_large")
     return t("downloads.errors.upload.tooLarge", { size: formatBytes(o.limit, i18n.language) });
   if (o?.code === "upload_empty") return t("downloads.errors.upload.empty");
@@ -136,7 +136,7 @@ function localizeDetail(d: unknown): string {
   // from that address" — so an unknown reason falls back to the generic refusal rather than a key.
   if (o?.code === "url_blocked")
     return t(`downloads.errors.urlBlocked.${o.reason}`, t("downloads.errors.urlBlocked.generic"));
-  // E10 S2: the one-step "move to another list". Both reasons mean the same thing to a reader —
+  // The one-step "move to another list". Both reasons mean the same thing to a reader —
   // the list moved under you — but they are different enough to be worth naming separately, and an
   // unknown reason falls back to the plain failure rather than printing a key.
   if (o?.code === "playlist_move")
@@ -267,7 +267,7 @@ export const setupHeaders = (token: string) => ({
 // sessionStorage (per-tab, survives F5, not shared across tabs). null = use the session default.
 // The storage key + reader live in storage.ts (so its per-account helpers can use them too).
 const ACTIVE_ACCOUNT_HEADER = "X-Siftlode-Account";
-// The debug session this tab is recording (E16): the server tags its own lines of the request with
+// The debug session this tab is recording: the server tags its own lines of the request with
 // it, and logs them at the session's level. Ignored by the server unless it is the caller's own.
 const DEBUG_SESSION_HEADER = "X-Debug-Session";