docs: api comments say what the endpoints do, not how they came to be (#6277)

Rewrites the internal/api comment blocks to rule 32: task, milestone and
rule ids gone, the stories behind them restated as the constraint they
left, stale references corrected (the stream secret is wired from config,
the timezone handler already refreshes the scheduler, the Android app is
the native client, the design docs cited are not in the repo). Also
rewraps comment lines over 80 columns left by the earlier batches.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/auth_test.go

@@ -77,7 +77,7 @@ func testHandlers(t *testing.T) (*handlers, *pgxpool.Pool) {
 
 // seedUser creates a test user. The supplied username is automatically
 // prefixed with dbtest.TestUserPrefix so dbtest.ResetDB cleans it up
-// without touching the operator's admin row. Callers that need to send
+// without touching the developer's admin row. Callers that need to send
 // the username in HTTP bodies or compare against API responses must
 // include the same prefix in their literals.
 func seedUser(t *testing.T, pool *pgxpool.Pool, username, password string, isAdmin bool) dbq.User {