docs(comments): correct comments the cuts left stale

The registration language is read today (preferences.language, the mail language); the Modal and
the players order against popovers through layerStack, not the FloatingTree; the upload's auth
dependency is current_user; the module of access tests covers onboarding and access, not only the
canonical email. The dev proxy's WebSocket upgrade served the removed messages socket and goes; the
test compose header says a pure-logic run needs SIFTLODE_TEST_REQUIRE_DB=0; the speed measure no
longer reports an unreachable database as "no share link".

frontend/src/lib/api/core.test.ts

@@ -434,7 +434,7 @@ describe("the debug session a tab records into", () => {
 
 // P1 — the upload's wire shape is a security boundary, not a detail. A multipart part is a DECLARED
 // body, which the server reads and spools BEFORE its auth dependency runs; the raw body is what lets
-// `require_human` resolve first. A revert to FormData here would silently re-open that, and the
+// `current_user` resolve first. A revert to FormData here would silently re-open that, and the
 // backend's own test only sees the shape the client actually sends.
 describe("uploadDownload's wire shape", () => {
   it("sends the File as the raw body, with the names as percent-encoded headers", () => {

frontend/src/lib/api/downloads.ts

@@ -198,7 +198,7 @@ export const downloadsApi = {
   // show upload progress; any file type is accepted (media gets the full function set, a generic
   // file is download-only). Returns the already-`done` job the ingest creates.
   // The body IS the file, and the two names ride as headers. Not a style choice: a multipart part is
-  // a DECLARED body, which FastAPI reads and spools BEFORE the route's `require_human` dependency
+  // a DECLARED body, which FastAPI reads and spools BEFORE the route's `current_user` dependency
   // runs — so with the old shape an unauthenticated caller could make the server write the whole
   // per-file allowance to temp (P1). Headers are latin-1 on the wire, hence `encodeURIComponent`;
   // the server percent-decodes both. Content-Type is left to the browser (the File's own type).