chore(comments): drop epic, sprint and review-round ids from the code

The code cited its plan instead of saying why: `E28 review J4`, `(R6 S3b)`, `S1 justified…`,
`deep-review round 5`. That plan lives in the private ops repo, so for every reader of this one the
citation was noise, and a sentence whose subject was the plan step ("round 2 showed…") hid its
lesson behind an id. Each one is gone and the "why" kept: a bare citation is deleted, a sentence
carrying a lesson is reworded around it ("a later attempt showed…").

Measured (`scripts/audit_metrics.py`, product code): 652 lines in 270 files carried an epic code by
the definition the next commit holds (507 / 241 by the old, two-digit-only one) -> 0. Across all
code, tests, scripts and configs: ~1100 epic-code lines plus ~320 sprint/round ids.

Behaviour unchanged, checked mechanically: every changed .py file has the same AST once docstrings
are blanked; css/sh/toml/yml/json files are identical once comments are stripped; the only
non-comment changes in TS/JS are test titles, one description string in a contract table, and five
ESLint messages, whose text is all the gates snapshot diff holds. Not touched: Markdown (docs and
the changelog keep their history), Alembic migrations, TV episode notation (`S2 · E5`), DESIGN.md
ids (`C1`, `B4`, `S3h`), tracker ids (`SEC-16`, `DX-17`).

One stale claim fixed on the way: test_hls_reaper's docstring said the player checkpoints "every
10 s whether or not it is playing", which plex/stream.py calls wrong; it now says what the code does.

frontend/src/lib/useVerifyEntry.ts

@@ -19,7 +19,7 @@ export type VerifyEntry = {
   /** A `#reset=` link opened in a tab that already holds a session. Only the signed-OUT auth card
    * consumes a reset token, so nothing here can act on it — but silence is what made the verify half
    * a bug, so this says out loud that the link needs a signed-out window. The fragment is deliberately
-   * left in the address bar (E9.5 review round 4), so signing out still recovers it. */
+   * left in the address bar, so signing out still recovers it. */
   resetPending: boolean;
   /** Dismiss the outcome — the banner is a one-time entry notice, not persistent state. */
   dismiss: () => void;
@@ -58,7 +58,7 @@ export function useVerifyEntry(): VerifyEntry {
       if (next) setToken(next);
       // Both halves of the mailed pair arrive the same way — pasted into a running tab, which is a
       // same-document navigation the import-time snapshot never sees. The verify half got this
-      // listener in E9.5 S2; the reset half was left out, so it stayed silent (DX-17).
+      // listener first; the reset half was left out, so it stayed silent (DX-17).
       //
       // Set from the live hash rather than one-way, because the flag must not outlive the token it
       // describes: navigating away from a `#reset=` (a pasted verify link, the back button) leaves