Server comments describe the code to a stranger (#6221)

Rule 32 "Comments describe the product to a stranger" sweep over
src/, alembic/ and tests/. Comments and docstrings now say what the code
does and the reason as a present-tense constraint, briefly.

Removed:
- issue, task, note, rule, milestone and family-idea references
- "used to" / before-and-after narration
- quotes of decisions and incident stories from the deploying instance
- paragraph-length arguments, where a line or two carries the fact

Kept every hazard as a present-tense fact, e.g. timing oracles, the
proxy hop direction, and migrations that must stay frozen.

Also:
- Three test names lose "still"/"used to"/"pre_m304" phrasing.
- pyproject's description drops "FabledSword family".

The history these comments carried stays in Scribe and in git log.
A comment-stripping diff (Scribe snippet #6226 "codeonly.py — prove a
diff changed only comments") shows no code changed apart from the
renamed tests and the description string.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_devices.py

@@ -34,18 +34,16 @@ async def test_revoke_self_requires_auth(app):
 
 
 def test_revoke_self_routes_to_the_self_revoke_view(app):
-    # The static rule must win over `/devices/<device_id>`: if "self" fell through to
-    # the id-keyed route it would be read as a malformed UUID and answer 404. Checked
-    # on the URL map, because every route behind login_required now reads the
-    # account's session epoch (#5173). The view's 400 for a caller with no bearer
-    # token is in test_integration.py.
+    # The static rule must win over `/devices/<device_id>`, or "self" would be read as
+    # a malformed UUID and 404. Checked on the URL map, because every route behind
+    # login_required reads the database. The view's 400 is in test_integration.py.
     endpoint, _ = app.url_map.bind("localhost").match("/api/auth/devices/self", method="DELETE")
     assert endpoint == "auth.revoke_own_device"
 
 
 async def test_device_login_validates_input(app):
-    # Missing credentials → 400 BEFORE any DB access, so it's checkable in the
-    # DB-free unit lane (invalid-cred and success paths are operator-verified).
+    # Missing credentials → 400 before any DB access, so it's checkable without a
+    # database. The other paths are in test_integration.py.
     client = app.test_client()
     resp = await client.post("/api/auth/device-login", json={})
     assert resp.status_code == 400