docs(auth): correct the last round of over-claiming comments and notes

Round 5's correctness/security pass came back clean; what was left was text that
said more than the code does.

- The register-path notify comment (and its test) claimed the admin "is still
  told". The call fires, but on a no-SMTP instance _send drops it — which is the
  open half of the problem, not something this branch fixed. Both now say so.
- The release notes tell admins what to actually do: an account whose address was
  whitelisted in advance has no pending request to approve, so the whitelist box
  is what activates it. That instruction only existed in the roadmap and in
  chores, which the dialog does not render.
- "That one line is the whole production change" now accounts for the test-only
  RateLimiter.reset() that also ships.
- The rate-limiter test claimed to pin that blocked attempts are not counted, on
  an assertion that held either way. Replaced with one that drives the clock
  across the window boundary and fails if hammering extends it.

backend/app/routes/auth.py

@@ -650,9 +650,11 @@ def _register_account(email: str, password: str) -> None:
             # Fragment (#), not a query token: keeps the token out of proxy/access logs + Referer (SB3).
             email_mod.send_verify_email(email, f"{_app_base()}/#verify={raw}")
         admins = admin_notify_emails(db)
-        # Unconditional, unlike the other two callers which gate on a fresh invite row: for an
-        # address the admin already approved this notice is the ONLY signal that someone has now
-        # created an account on it, and that account is inactive until the admin acts.
+        # Fired unconditionally, unlike the other two callers which gate on a fresh invite row: for
+        # an address the admin already approved, nothing lands in the Access-requests queue, so this
+        # is the only place the account's existence is announced at all. Delivery is a separate
+        # matter — with no working SMTP `_send` drops it, which is why the pre-approved registrant
+        # still needs the admin to notice them (roadmap UX-25).
         if admins:
             email_mod.send_admin_new_request(admins, email)