fix(gate): the plan-code guard catches bare sprint and phase codes, and the purge takes the P ones

The sprint alternative matched only `(S6)` or `S3e2`, so the commonest purged form (`# S6:`,
`S3's`, `"""S6 —`, `S1 justified`) and every phase code (`P1`) would come back unflagged; the phase
codes had in fact survived the purge in 16 lines (Plex client sections, the upload's header shape),
now reworded around them.

One pattern now covers epic, roadmap, sprint and phase codes; the named exceptions are TV episode
notation, a fixture's season or episode title (`title="S1"`) and ruff's `E4/E7/E9`, and a ruff rule
like `S110` does not match. The case test lists the purged forms and no longer claims every form.
audit_metrics copies the definition (ASCII, as JavaScript's \b is) and reports it as
plan_code_lines / plan_code_files.

backend/app/plex/client.py

@@ -2,7 +2,7 @@
 
 Server-side ONLY: uses the admin ``X-Plex-Token`` from sysconfig. Playback never goes through
 this client — Siftlode plays the LOCAL physical file (see app.plex.paths). Plex is used purely for
-metadata, image proxying, and (P5) optional watch-state write-back. Requests JSON via the
+metadata, image proxying, and optional watch-state write-back. Requests JSON via the
 ``Accept: application/json`` header (Plex serves XML by default).
 """
 
@@ -65,7 +65,7 @@ class PlexClient:
         except ValueError as e:
             raise PlexError("Plex returned a non-JSON response") from e
 
-    # --- Connectivity + sections (P0) ---
+    # --- Connectivity + sections ---
     def server_info(self) -> dict:
         """Root identity (friendlyName / version) — used by the admin 'Test connection'."""
         return self._get("/")
@@ -75,7 +75,7 @@ class PlexClient:
         mc = self._get("/library/sections")
         return mc.get("Directory", []) or []
 
-    # --- Catalog mirror (P1) ---
+    # --- Catalog mirror ---
     def section_items(
         self, key: str, item_type: int, start: int = 0, size: int = 200
     ) -> tuple[list[dict], int | None]:
@@ -137,7 +137,7 @@ class PlexClient:
         mc = self._get(f"/library/collections/{rating_key}/children")
         return mc.get("Metadata", []) or []
 
-    # --- Collection editing (P2 — write-back to Plex; all shared/global, admin-gated in the routes) ---
+    # --- Collection editing (write-back to Plex; all shared/global, admin-gated in the routes) ---
     @property
     def machine_id(self) -> str:
         """Server machineIdentifier — needed in the `uri` of collection add/create calls. Cached.
@@ -206,7 +206,7 @@ class PlexClient:
         items = mc.get("Metadata", []) or []
         return items[0] if items else None
 
-    # --- Watch-state write-back (P5 Phase B — Siftlode→Plex push; acts on the token's account) ---
+    # --- Watch-state write-back (Siftlode→Plex push; acts on the token's account) ---
     _LIBRARY_IDENTIFIER = "com.plexapp.plugins.library"
 
     def scrobble(self, rating_key: str) -> None:
@@ -243,7 +243,7 @@ class PlexClient:
             f"&state={state}&time={int(time_ms)}&duration={int(duration_ms)}",
         )
 
-    # --- Watch-state read for incremental sync (P5 Phase C) ---
+    # --- Watch-state read for incremental sync ---
     def accounts(self) -> list[dict]:
         """Server accounts (the owner + any managed/home users): id, name. Used to resolve the
         owner's accountID so the shared watch-history feed can be filtered to just their views."""

backend/app/routes/downloads.py

@@ -413,7 +413,7 @@ def enqueue_download(
 # The upload's filename and display name travel as HEADERS, not as multipart parts. That is not a
 # style choice: a DECLARED body parameter (`file: UploadFile = File(...)`) is read and spooled by
 # FastAPI *before the first dependency runs*, so the auth dependency could not gate it and an anonymous
-# caller could make the process write the whole per-file allowance to temp, per request (P1; SEC-20
+# caller could make the process write the whole per-file allowance to temp, per request (SEC-20
 # bounded the number but could not stop the writing). Reading the body ourselves, from a dependency
 # declared AFTER the auth one, is the only shape that closes it — the same one
 # `POST /api/debug-sessions/{sid}/screenshots` uses, and `test_body_limit.py` now enforces it for

backend/app/sysconfig.py

@@ -140,7 +140,7 @@ SPECS: tuple[ConfigSpec, ...] = (
         max=100_000,
     ),
     # min=1, NOT 0: a stored 0 used to read as "no per-file cap" (the cap was enforced as
-    # `if cap and size > cap`, so a falsy value disabled it). Since P1 the route passes this number
+    # `if cap and size > cap`, so a falsy value disabled it). Now the route passes this number
     # straight to `capped_stream_to`, where 0 would refuse every upload instead — the opposite
     # failure, and the reason `config.download_upload_max_bytes` carries its own `ge=1`. Either way
     # a stored 0 is wrong, so it is floored at 1; the overall footprint is separately bounded by the

backend/tests/conftest.py

@@ -254,7 +254,7 @@ def as_user(db, override_dep, _configured):
 
 @pytest.fixture
 def upload_headers():
-    """Build the headers `POST /api/downloads/upload` takes since P1.
+    """Build the headers `POST /api/downloads/upload` takes (the file is the raw body).
 
     Shared, because two test modules drive that route and a second copy of this is exactly the drift
     that lets the wire shape change in one place only. The body IS the file now; the names ride as

backend/tests/test_upload.py

@@ -600,7 +600,7 @@ def test_the_display_name_header_reaches_the_job_and_is_bounded(
 ):
     """The second header, which had no backend test at all — and the length nothing bounded.
 
-    Since P1 the display name arrives in a REQUEST HEADER rather than as a form field, so the only
+    The display name arrives in a REQUEST HEADER rather than as a form field, so the only
     limit on it was the header size. The column is varchar(255), so a longer one reached Postgres as
     a DataError: a 500 AFTER the whole file had been transferred. It is truncated now, by the same
     helper the metadata PATCH uses.
@@ -627,7 +627,7 @@ def test_the_display_name_header_reaches_the_job_and_is_bounded(
 def test_the_upload_holds_no_db_transaction_while_the_body_streams(
     as_user, make_user, db, _root, monkeypatch, upload_headers
 ):
-    """P1 moved the body read behind the auth dependency, which put the whole transfer INSIDE the
+    """Moving the body read behind the auth dependency put the whole transfer INSIDE the
     request's database session: resolving the caller and reading the cap are SELECTs, SQLAlchemy 2.0
     autobegins on the first one, and the session then holds one of the twenty pooled connections —
     `idle in transaction` to Postgres, with no `idle_in_transaction_session_timeout` to end it — for