Server comments describe the code to a stranger (#6221)

Rule 32 "Comments describe the product to a stranger" sweep over
src/, alembic/ and tests/. Comments and docstrings now say what the code
does and the reason as a present-tense constraint, briefly.

Removed:
- issue, task, note, rule, milestone and family-idea references
- "used to" / before-and-after narration
- quotes of decisions and incident stories from the deploying instance
- paragraph-length arguments, where a line or two carries the fact

Kept every hazard as a present-tense fact, e.g. timing oracles, the
proxy hop direction, and migrations that must stay frozen.

Also:
- Three test names lose "still"/"used to"/"pre_m304" phrasing.
- pyproject's description drops "FabledSword family".

The history these comments carried stays in Scribe and in git log.
A comment-stripping diff (Scribe snippet #6226 "codeonly.py — prove a
diff changed only comments") shows no code changed apart from the
renamed tests and the description string.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_ratelimit.py

@@ -1,12 +1,8 @@
 """The credential throttle. DB-free, like the rest of this suite.
 
-The window itself is exercised directly with an injected clock, so nothing here
-sleeps: a 15-minute window tested in real time is a test nobody runs twice.
-
-The routes are exercised only as far as they get WITHOUT a database — a throttled
-request returns 429 before any session is opened, which is the whole point of
-checking the limit before the password. The happy path can't be reached here and is
-not pretended at.
+The window is exercised with an injected clock, so nothing sleeps. The routes are
+exercised only as far as they get without a database: a throttled request returns
+429 before any session is opened.
 """
 import time
 
@@ -101,9 +97,8 @@ async def test_login_starts_refusing(app):
     # Pre-load the account's counter to its limit rather than posting that many
     # times: every real attempt would need a database to reach the password check.
     #
-    # On the REAL clock, not an injected one. The window is trailing, so hits stamped
-    # at t=0..9 are fifteen minutes stale the moment the route reads
-    # `time.monotonic()` and get pruned before they can refuse anything.
+    # On the real clock: hits stamped at t=0..9 would be pruned as stale the moment
+    # the route reads `time.monotonic()`.
     now = time.monotonic()
     for _ in range(live("signin_limit_per_account")):
         ratelimit.sign_in_by_account.record("someone@example.com", now=now)