docs(auth): correct the last round of over-claiming comments and notes

Round 5's correctness/security pass came back clean; what was left was text that
said more than the code does.

- The register-path notify comment (and its test) claimed the admin "is still
  told". The call fires, but on a no-SMTP instance _send drops it — which is the
  open half of the problem, not something this branch fixed. Both now say so.
- The release notes tell admins what to actually do: an account whose address was
  whitelisted in advance has no pending request to approve, so the whitelist box
  is what activates it. That instruction only existed in the roadmap and in
  chores, which the dialog does not render.
- "That one line is the whole production change" now accounts for the test-only
  RateLimiter.reset() that also ships.
- The rate-limiter test claimed to pin that blocked attempts are not counted, on
  an assertion that held either way. Replaced with one that drives the clock
  across the window boundary and fails if hammering extends it.

backend/tests/test_auth_session.py

@@ -183,8 +183,9 @@ def test_registration_of_a_pre_approved_email_persists_the_account_without_smtp(
     # so their Google sign-in keeps working and an anonymous sign-up cannot revoke access.
     assert invite.status == "approved"
     assert invite.decided_by == "admin@example.com"
-    # The admin is still told: for an already-approved address this notice is their only signal
-    # that an account now exists on it, and it is inactive until they act.
+    # The notify path still fires for an already-approved address — nothing lands in the queue, so
+    # it is the only announcement there is. (Whether it is DELIVERED is separate: on a real no-SMTP
+    # instance `_send` drops it, which is the open half of the problem, roadmap UX-25.)
     assert notified == ["roland@example.com"]