docs: web comments say what the app does, not how it came to be (#6277)

Rewrites the web app's comments to rule 32. Task, milestone, rule and
spec ids are gone; regression stories are restated as the trap they
guard (public auth routes, the menu's stopPropagation, universal loads
under adapter-static, metric deltas with their margin). Flutter and
Tauri mentions now name the Android app or a native shell, operator
quotes and dates are dropped, and one library's counts no longer
appear outside test fixtures. Verified with a TypeScript-scanner token
comparison (template literals and regex literals re-scanned): only
comment text changed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/csp_test.go

@@ -49,7 +49,7 @@ func TestContentSecurityPolicy_HashesInlineScriptsOnly(t *testing.T) {
 }
 
 // The hash must be of the page as served, after the branding template has
-// substituted the operator's app name, or a renamed instance would refuse
+// substituted the app's name, or a renamed instance would refuse
 // its own bootstrap script.
 func TestContentSecurityPolicy_TracksTemplatedContent(t *testing.T) {
 	a := contentSecurityPolicy([]byte(`<script>window.__MINSTREL__ = { appName: "A" };</script>`))