chore(comments): drop epic, sprint and review-round ids from the code

The code cited its plan instead of saying why: `E28 review J4`, `(R6 S3b)`, `S1 justified…`,
`deep-review round 5`. That plan lives in the private ops repo, so for every reader of this one the
citation was noise, and a sentence whose subject was the plan step ("round 2 showed…") hid its
lesson behind an id. Each one is gone and the "why" kept: a bare citation is deleted, a sentence
carrying a lesson is reworded around it ("a later attempt showed…").

Measured (`scripts/audit_metrics.py`, product code): 652 lines in 270 files carried an epic code by
the definition the next commit holds (507 / 241 by the old, two-digit-only one) -> 0. Across all
code, tests, scripts and configs: ~1100 epic-code lines plus ~320 sprint/round ids.

Behaviour unchanged, checked mechanically: every changed .py file has the same AST once docstrings
are blanked; css/sh/toml/yml/json files are identical once comments are stripped; the only
non-comment changes in TS/JS are test titles, one description string in a contract table, and five
ESLint messages, whose text is all the gates snapshot diff holds. Not touched: Markdown (docs and
the changelog keep their history), Alembic migrations, TV episode notation (`S2 · E5`), DESIGN.md
ids (`C1`, `B4`, `S3h`), tracker ids (`SEC-16`, `DX-17`).

One stale claim fixed on the way: test_hls_reaper's docstring said the player checkpoints "every
10 s whether or not it is playing", which plex/stream.py calls wrong; it now says what the code does.

frontend/src/lib/entryUrl.ts

@@ -19,7 +19,7 @@ export const entryHash = new URLSearchParams(window.location.hash.replace(/^#/,
 
 /** One-time QUERY flags: safe to drop once the snapshot above has them, because re-reading them on a
  * reload would re-show a notice about something that already happened (`access` only appears here
- * in its pre-S4 shape — it rides the fragment now). Deliberately NOT `link`,
+ * in its old shape — it rides the fragment now). Deliberately NOT `link`,
  * `oauth`, `admin` or the setup `token` — those have their own readers, and some of them (the setup
  * wizard, the lazily-mounted module views) do not run until several commits later. */
 const ONE_TIME_QUERY = ["login", "deleted", "access"] as const;
@@ -30,7 +30,7 @@ const ONE_TIME_QUERY = ["login", "deleted", "access"] as const;
  *
  * SURGICAL, and that is the whole of it. This used to blank the entire query string, the fragment
  * and `history.state`, which was safe only while it lived inside the signed-out auth card; moving it
- * up to App (E9.5 S2) pointed it at every load. It then ran on the FIRST commit — before the setup
+ * up to App pointed it at every load. It then ran on the FIRST commit — before the setup
  * wizard mounts behind its own `?token=`, before App's own `?link=`/`?oauth=` effects read theirs,
  * and before a lazily-loaded module view reads its `?v=`/`?chan=` deep link — and took
  * `history.state` (scroll restoration, the channel entry) with it. Everything not listed above is
@@ -45,7 +45,7 @@ export function clearEntryUrl(): void {
   // again does the same, because the token is untouched and the session is still there. Leaving it
   // in the address bar keeps the recovery `main` had, where this strip lived inside the auth card:
   // sign out (which reloads, fragment intact) and the reset form is waiting. Once the card has used
-  // it the token is spent, so a later reload meets S4's named dead-link screen — which is true.
+  // it the token is spent, so a later reload meets the named dead-link screen — which is true.
   const hash = new URLSearchParams(window.location.hash.replace(/^#/, ""));
   const keep = hash.has("reset") ? window.location.hash : "";
   if (!dropped.length && !window.location.hash) return;