Server comments describe the code to a stranger (#6221)

Rule 32 "Comments describe the product to a stranger" sweep over
src/, alembic/ and tests/. Comments and docstrings now say what the code
does and the reason as a present-tense constraint, briefly.

Removed:
- issue, task, note, rule, milestone and family-idea references
- "used to" / before-and-after narration
- quotes of decisions and incident stories from the deploying instance
- paragraph-length arguments, where a line or two carries the fact

Kept every hazard as a present-tense fact, e.g. timing oracles, the
proxy hop direction, and migrations that must stay frozen.

Also:
- Three test names lose "still"/"used to"/"pre_m304" phrasing.
- pyproject's description drops "FabledSword family".

The history these comments carried stays in Scribe and in git log.
A comment-stripping diff (Scribe snippet #6226 "codeonly.py — prove a
diff changed only comments") shows no code changed apart from the
renamed tests and the description string.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_proxy.py

@@ -11,13 +11,9 @@ PEER = "10.0.0.1"  # the socket address: our own proxy, or the caller when unpro
 
 
 def test_default_is_one_hop():
-    # One reverse proxy terminating TLS — this deployment, and the only shape that is
-    # safe to assume. A wrong default here is a silent security bug, not a preference.
-    #
-    # Read through live() rather than the registry: live() is what proxy.py actually
-    # calls, and it is seeded from the defaults at import time so the value is right
-    # before the first database read. A boot that never reached the DB must still
-    # count one hop, not zero.
+    # One reverse proxy terminating TLS, the only shape safe to assume. Read through
+    # live(), which proxy.py calls and which is seeded from the defaults at import, so
+    # a boot that never reached the database still counts one hop.
     assert live("trusted_proxy_hops") == 1
 
 
@@ -32,9 +28,8 @@ def test_one_hop_reads_what_our_proxy_wrote():
 
 
 def test_a_forged_prefix_is_never_selected():
-    # THE test. A caller sends `X-Forwarded-For: 1.2.3.4`; our proxy appends the
-    # address it actually saw. Reading from the left would hand the caller a fresh
-    # rate-limit bucket for every value they invent.
+    # A caller sends `X-Forwarded-For: 1.2.3.4`; our proxy appends what it saw.
+    # Reading from the left would give the caller a fresh bucket per invented value.
     assert forwarded_for("1.2.3.4, 203.0.113.7", PEER, 1) == "203.0.113.7"
     # …and padding it doesn't help either.
     assert forwarded_for("a, b, c, d, 203.0.113.7", PEER, 1) == "203.0.113.7"
@@ -47,9 +42,8 @@ def test_two_hops_sees_past_a_cdn():
 
 
 def test_a_short_header_falls_back_rather_than_reaching_left():
-    # Fewer proxies than configured. Reaching further left would start believing
-    # entries no proxy of ours wrote, so the safe direction is the socket address —
-    # at worst several callers share one bucket.
+    # Fewer proxies than configured: the socket address, rather than an entry no
+    # proxy of ours wrote.
     assert forwarded_for("203.0.113.7", PEER, 2) == PEER
     assert forwarded_for("", PEER, 1) == PEER