docs(comments): no WebSocket and no CI in the present tense

The chat cut removed the only WebSocket and CI went before it, but comments still leaned on both:
`?account=` was justified by the socket, job polling by an in-process WS registry, the e2e flows as
"proxy-safe (none use the WebSocket)", and pyrightconfig named a CI container the engine contract
test never checked. Each now says what holds today (the wallet gate, no push channel, the two
contract test halves, the image build's `npm ci`, the gate).

backend/app/models.py

@@ -889,8 +889,8 @@ class DownloadJob(Base, TimestampMixin, UpdatedAtMixin):
     """A user's request to download one source — the per-user layer over `MediaAsset`.
 
     The worker claims `queued` jobs with ``FOR UPDATE SKIP LOCKED`` and writes live
-    `progress`/`speed_bps`/`eta_s`/`phase` here (the frontend polls via useLiveQuery — the
-    worker is a separate process and can't reach the in-process WS registry). `profile_snapshot`
+    `progress`/`speed_bps`/`eta_s`/`phase` here (the frontend polls via useLiveQuery: there is
+    no server push channel, and the worker is a separate process anyway). `profile_snapshot`
     freezes the spec at enqueue so later edits/deletion of the profile don't change this job.
     `display_name` is the user's own name for the file (display + the Content-Disposition on
     local download); the on-disk asset is never renamed. `asset_id` links to the shared file

backend/pyrightconfig.json

@@ -13,8 +13,8 @@
 // image installs — so the lane's version IS the pin, with no host-vs-pin check to drift.
 //
 // `pythonVersion` is not free-standing: `/.python-version` is the single source of truth and
-// `tests/test_python_engine_contract.py` fails this gate if this file, the two Dockerfiles, the CI
-// container or ruff's target-version disagree with it.
+// `tests/test_python_engine_contract.py` (with its host half, pythonEngine.contract.test.ts) fails
+// this gate if this file, the two Dockerfiles or ruff's target-version disagree with it.
 //
 // `include` covers `alembic` for the same reason the ruff lane was widened to it: migrations run on
 // every container start, so one that raises there crash-loops prod, and "it is generated code" is

backend/tests/test_plex_stream.py

@@ -331,7 +331,7 @@ class TestWantHw:
 
     @staticmethod
     def _opencl(monkeypatch, present):
-        # Pin the OpenCL-runtime probe so the routing doesn't depend on the CI box's /etc/OpenCL.
+        # Pin the OpenCL-runtime probe so the routing doesn't depend on the test machine's /etc/OpenCL.
         monkeypatch.setattr(stream, "_opencl_present", lambda: present)
 
     def test_no_hw_when_not_transcoding(self, monkeypatch):