docs: api comments say what the endpoints do, not how they came to be (#6277)

Rewrites the internal/api comment blocks to rule 32: task, milestone and
rule ids gone, the stories behind them restated as the constraint they
left, stale references corrected (the stream secret is wired from config,
the timezone handler already refreshes the scheduler, the Android app is
the native client, the design docs cited are not in the repo). Also
rewraps comment lines over 80 columns left by the earlier batches.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/auth_forgot.go

@@ -130,15 +130,15 @@ func (h *handlers) sendResetEmail(ctx context.Context, user dbq.User) error {
 	return h.mailer.Send(ctx, *user.Email, mailer.ResetEmailSubject, textBody, htmlBody)
 }
 
-// errNoPublicURL stops a reset email from going out before the operator has
+// errNoPublicURL stops a reset email from going out before an admin has
 // said where Minstrel lives. It surfaces in the log, not the response, which
 // stays the same opaque 200 either way.
 var errNoPublicURL = errors.New("forgot-password: no public URL set (Admin › Email & network › Public address); reset email not sent")
 
-// buildResetURL builds the emailed link from the operator-set public URL.
+// buildResetURL builds the emailed link from an admin-set public URL.
 // It deliberately ignores the request: the Host header is whatever the
-// requester sent, and building from it let a forged Host plant a real reset
-// token on a link to someone else's server.
+// requester sent, and building from it would let a forged Host plant a real
+// reset token on a link to someone else's server.
 func buildResetURL(publicURL, token string) (string, error) {
 	if publicURL == "" {
 		return "", errNoPublicURL