docs(comments): correct comments the cuts left stale

The registration language is read today (preferences.language, the mail language); the Modal and
the players order against popovers through layerStack, not the FloatingTree; the upload's auth
dependency is current_user; the module of access tests covers onboarding and access, not only the
canonical email. The dev proxy's WebSocket upgrade served the removed messages socket and goes; the
test compose header says a pure-logic run needs SIFTLODE_TEST_REQUIRE_DB=0; the speed measure no
longer reports an unreachable database as "no share link".

frontend/src/components/ui/AnchoredPopover.tsx

@@ -28,7 +28,8 @@ import type { useAnchoredPopover } from "./anchoredPopoverHooks";
 //   - autoUpdate → follows the trigger on scroll/resize (the old rAF loop), coalesced by the library
 // Positioning is portalled through FloatingPortal (escapes ancestor stacking contexts — same job the
 // house <Overlay> did for TagsCell). Every popover is a node in the app's <FloatingTree> so Escape /
-// outside-press dispatch is topmost-only across nested layers (the Modal and players included).
+// outside-press dispatch is topmost-only across nested popovers; against the Modal and the players,
+// which are not nodes, it is lib/layerStack that decides who is topmost.
 //
 // This layer adds the keyboard/ARIA model the roles promise, mirroring `ViewSwitcher` (the house's
 // textbook menu) but via Floating UI's idioms rather than a second hand-rolled roving engine:

frontend/src/lib/api/core.test.ts

@@ -434,7 +434,7 @@ describe("the debug session a tab records into", () => {
 
 // P1 — the upload's wire shape is a security boundary, not a detail. A multipart part is a DECLARED
 // body, which the server reads and spools BEFORE its auth dependency runs; the raw body is what lets
-// `require_human` resolve first. A revert to FormData here would silently re-open that, and the
+// `current_user` resolve first. A revert to FormData here would silently re-open that, and the
 // backend's own test only sees the shape the client actually sends.
 describe("uploadDownload's wire shape", () => {
   it("sends the File as the raw body, with the names as percent-encoded headers", () => {

frontend/src/lib/api/downloads.ts

@@ -198,7 +198,7 @@ export const downloadsApi = {
   // show upload progress; any file type is accepted (media gets the full function set, a generic
   // file is download-only). Returns the already-`done` job the ingest creates.
   // The body IS the file, and the two names ride as headers. Not a style choice: a multipart part is
-  // a DECLARED body, which FastAPI reads and spools BEFORE the route's `require_human` dependency
+  // a DECLARED body, which FastAPI reads and spools BEFORE the route's `current_user` dependency
   // runs — so with the old shape an unauthenticated caller could make the server write the whole
   // per-file allowance to temp (P1). Headers are latin-1 on the wire, hence `encodeURIComponent`;
   // the server percent-decodes both. Content-Type is left to the browser (the File's own type).

frontend/src/main.tsx

@@ -77,7 +77,8 @@ const root =
   ) : (
     <QueryClientProvider client={queryClient}>
       {/* One tree for the whole app: every anchored popover registers as a node so Escape and
-          outside-press act only on the topmost layer (the Modal and the players join it too). */}
+          outside-press act only on the topmost popover. The Modal and the players are not nodes:
+          they order against the popovers through lib/layerStack. */}
       <FloatingTree>
         <ConfirmProvider>
           {/* Nothing below renders until the tab knows which account it is: every provider