docs: web comments say what the app does, not how it came to be (#6277)

Rewrites the web app's comments to rule 32. Task, milestone, rule and
spec ids are gone; regression stories are restated as the trap they
guard (public auth routes, the menu's stopPropagation, universal loads
under adapter-static, metric deltas with their margin). Flutter and
Tauri mentions now name the Android app or a native shell, operator
quotes and dates are dropped, and one library's counts no longer
appear outside test fixtures. Verified with a TypeScript-scanner token
comparison (template literals and regex literals re-scanned): only
comment text changed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/csp.go

@@ -20,7 +20,7 @@ var srcAttrRe = regexp.MustCompile(`(?i)\bsrc\s*=`)
 // page carries: the theme bootstrap in app.html, the branding global the Vite
 // plugin injects, and SvelteKit's start-up block. Their hashes are taken from
 // the page AFTER the branding template has run, so they match the bytes the
-// browser actually receives, whatever the operator's app name. Any script
+// browser actually receives, whatever the app is named. Any script
 // that differs, including one injected through an XSS, is refused.
 //
 // The rest: