docs(comments): no WebSocket and no CI in the present tense

The chat cut removed the only WebSocket and CI went before it, but comments still leaned on both:
`?account=` was justified by the socket, job polling by an in-process WS registry, the e2e flows as
"proxy-safe (none use the WebSocket)", and pyrightconfig named a CI container the engine contract
test never checked. Each now says what holds today (the wallet gate, no push channel, the two
contract test halves, the image build's `npm ci`, the gate).

frontend/src/lib/api/facade.test.ts

@@ -3,7 +3,8 @@ import { describe, it, expect, beforeAll } from "vitest";
 // The façade guard: lib/api.ts is a spread-only façade over per-domain slice modules. These tests
 // mechanise the two invariants that make that structure safe — so a future edit that reintroduces
 // the interleave (a method dropped into two slices → a silent last-wins spread override) or bloats
-// the barrel (a method defined inline instead of in a domain module) fails CI instead of shipping.
+// the barrel (a method defined inline instead of in a domain module) fails the gate instead of
+// shipping.
 //
 // Scope, on purpose: this covers RUNTIME method-key collisions — the only *silent* failure mode,
 // since tsc does not flag overlapping spread keys. It deliberately does NOT cover exported-TYPE-name