chore(comments): drop epic, sprint and review-round ids from the code

The code cited its plan instead of saying why: `E28 review J4`, `(R6 S3b)`, `S1 justified…`,
`deep-review round 5`. That plan lives in the private ops repo, so for every reader of this one the
citation was noise, and a sentence whose subject was the plan step ("round 2 showed…") hid its
lesson behind an id. Each one is gone and the "why" kept: a bare citation is deleted, a sentence
carrying a lesson is reworded around it ("a later attempt showed…").

Measured (`scripts/audit_metrics.py`, product code): 652 lines in 270 files carried an epic code by
the definition the next commit holds (507 / 241 by the old, two-digit-only one) -> 0. Across all
code, tests, scripts and configs: ~1100 epic-code lines plus ~320 sprint/round ids.

Behaviour unchanged, checked mechanically: every changed .py file has the same AST once docstrings
are blanked; css/sh/toml/yml/json files are identical once comments are stripped; the only
non-comment changes in TS/JS are test titles, one description string in a contract table, and five
ESLint messages, whose text is all the gates snapshot diff holds. Not touched: Markdown (docs and
the changelog keep their history), Alembic migrations, TV episode notation (`S2 · E5`), DESIGN.md
ids (`C1`, `B4`, `S3h`), tracker ids (`SEC-16`, `DX-17`).

One stale claim fixed on the way: test_hls_reaper's docstring said the player checkpoints "every
10 s whether or not it is playing", which plex/stream.py calls wrong; it now says what the code does.

frontend/src/lib/log.ts

@@ -1,11 +1,11 @@
-// The client log (E22 S4): the browser half of the ONE event shape `backend/app/logs.py` defines.
+// The client log: the browser half of the ONE event shape `backend/app/logs.py` defines.
 //
 // Every event is `{ts, level, sev, source: "web", event, msg, attrs, request_id?, tab_id, version}` —
 // the same fields and level names as a server line, so a client batch can land in `log_events` beside
 // the server's own rows and a request joins across the two by `request_id`.
 //
 // Events are kept in memory only, in a bounded ring: nothing leaves the browser from here. Sending
-// them is `lib/diagnostics.ts`'s job, and only while the user's consented level is raised (E22 S5);
+// them is `lib/diagnostics.ts`'s job, and only while the user's consented level is raised;
 // it and the Settings log viewer follow the ring through `subscribe`.
 //
 // REDACTION HAPPENS HERE, at capture, not at the call site — the same rules as the server's handler,
@@ -55,7 +55,7 @@ export interface LogEvent {
   request_id?: string;
   tab_id: string;
   version: string;
-  /** The debug session recording when the event was kept (E16). */
+  /** The debug session recording when the event was kept. */
   debug_session_id?: string;
 }
 
@@ -142,7 +142,7 @@ const TAB_ID = tabId();
 // --- the logger -----------------------------------------------------------------------------------
 let threshold: Level = "INFO";
 let ring: LogEvent[] = [];
-// The debug session this tab is recording into (E16), or null. Held HERE, the lowest layer, because
+// The debug session this tab is recording into, or null. Held HERE, the lowest layer, because
 // two things below everything else need it: every kept event carries it, and `api/core` puts it on
 // every request as `X-Debug-Session` — which is how the server tags its own lines of that request.
 let debugSession: string | null = null;
@@ -158,7 +158,7 @@ export function currentDebugSession(): string | null {
 }
 
 /** The capture level. INFO is the always-on "Alap"; DEBUG and TRACE come from the user's consented
- *  diagnostics level (E22 S5). */
+ *  diagnostics level. */
 export function setLevel(level: Level): void {
   threshold = level;
 }