docs: api comments say what the endpoints do, not how they came to be (#6277)

Rewrites the internal/api comment blocks to rule 32: task, milestone and
rule ids gone, the stories behind them restated as the constraint they
left, stale references corrected (the stream secret is wired from config,
the timezone handler already refreshes the scheduler, the Android app is
the native client, the design docs cited are not in the repo). Also
rewraps comment lines over 80 columns left by the earlier batches.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/stream_token.go

@@ -15,10 +15,9 @@ import (
 // trackID is the canonical track UUID. exp is the Unix time after which
 // the token is invalid; the handler checks exp before serving.
 //
-// The secret comes from MINSTREL_STREAM_SECRET (or its auto-generated +
-// persisted fallback in app_preferences). The loader lands in slice 2
-// (POST /api/cast/stream-token); this file is the primitive both the
-// loader and the stream handler share.
+// The secret comes from MINSTREL_STREAM_SECRET, or its auto-generated
+// fallback persisted under the data directory. This file is the primitive
+// the token endpoint and the stream handler share.
 func SignStreamToken(secret []byte, trackID string, exp int64) string {
 	mac := hmac.New(sha256.New, secret)
 	// hash.Hash.Write is documented as never returning an error.