docs(comments): correct comments the cuts left stale

The registration language is read today (preferences.language, the mail language); the Modal and
the players order against popovers through layerStack, not the FloatingTree; the upload's auth
dependency is current_user; the module of access tests covers onboarding and access, not only the
canonical email. The dev proxy's WebSocket upgrade served the removed messages socket and goes; the
test compose header says a pure-logic run needs SIFTLODE_TEST_REQUIRE_DB=0; the speed measure no
longer reports an unreachable database as "no share link".

backend/tests/test_review_round.py

@@ -1,10 +1,13 @@
-"""Review round — the invariants the canonical-email work's own review found unpinned.
+"""The onboarding and access invariants a review of that work found unpinned.
 
 Every test here corresponds to a defect a reviewer could still introduce with the whole suite green:
-a mail whose body never renders in any test, an activation that only works for the exact spelling, a
-"we already wrote to them" stamp for a mail that was dropped, an env allow-list that answers a
-different question than the gate it backs, and the address pre-emption that the order-independent
-gates' argument covered only while the address stayed unverified.
+a mail whose body never renders in some language, a link lifetime described in the wrong unit, a
+registration that rewrites an existing password or kills a link already in flight, an activation
+that only works for the exact spelling, a "we already wrote to them" stamp for a mail that was
+dropped, an env allow-list that answers a different question than the gate it backs, a reset or
+resend that reports success it did not have, and a throttle that leaks whether an account exists.
+Approval's password revoke was called redundant because `password_login` refuses an unverified
+account; that holds only until the address is verified, which is what the tests on pre-emption pin.
 """
 
 from datetime import datetime, timedelta, timezone