docs: api comments say what the endpoints do, not how they came to be (#6277)

Rewrites the internal/api comment blocks to rule 32: task, milestone and
rule ids gone, the stories behind them restated as the constraint they
left, stale references corrected (the stream secret is wired from config,
the timezone handler already refreshes the scheduler, the Android app is
the native client, the design docs cited are not in the repo). Also
rewraps comment lines over 80 columns left by the earlier batches.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/media.go

@@ -125,17 +125,14 @@ func (h *handlers) handleGetCover(w http.ResponseWriter, r *http.Request) {
 // stream — either via the standard session path (cookie OR bearer token
 // resolved to a user-in-context by auth.OptionalUser, the middleware
 // the route is wrapped with in api.go) OR via a valid short-lived HMAC
-// token in the ?token=&exp= query (UPnP / Sonos path, new for the
-// output-picker UPnP slice).
+// token in the ?token=&exp= query (the UPnP / Sonos path).
 //
 // The token path lets network speakers fetch the stream URL without
-// carrying the user's session cookie — they cannot. See the design at
-// docs/superpowers/specs/2026-06-03-android-output-picker-upnp-design.md.
+// carrying the user's session cookie — they cannot.
 //
-// When h.streamSecret is nil (slice-1 default, until slice 2 wires the
-// loader), the token path always rejects because the HMAC of an empty
-// key won't match any token a client could mint. The session path keeps
-// working.
+// When h.streamSecret is nil the token path always rejects, because the
+// HMAC of an empty key won't match any token a client could mint. The
+// session path keeps working.
 func (h *handlers) streamAuthOk(r *http.Request, trackID string) bool {
 	if _, ok := auth.UserFromContext(r.Context()); ok {
 		return true
@@ -194,9 +191,9 @@ func (h *handlers) handleGetStream(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Accept-Ranges", "bytes")
 	// Track bytes are immutable for a given track id (the scanner
 	// indexes by file_path; re-encoded files take new ids). One-year
-	// max-age + immutable lets the client cache (LockCachingAudioSource
-	// on the Flutter side, browser cache on web) skip even the
-	// conditional GET on repeat plays.
+	// max-age + immutable lets the client cache (Media3's cache on Android,
+	// the browser cache on web) skip even the conditional GET on repeat
+	// plays.
 	w.Header().Set("Cache-Control", "private, max-age=31536000, immutable")
 	http.ServeContent(w, r, filepath.Base(track.FilePath), info.ModTime(), f)
 }