docs: migration headers keep the before and after, without ids, quotes or one library's numbers (#6277)

Applies rule 32's migration exception: each header still says what the
schema was, what changes and what it prevents, but task, milestone,
decision and rule ids are replaced by the practice they stood for, the
operator quotes by the decision, single-install counts are dropped, and
pointers to a deleted package and an external design doc are gone.
golang-migrate keeps no checksum, so editing applied migrations'
comments is safe.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/db/migrations/0053_network_settings.up.sql

@@ -1,4 +1,4 @@
--- Trusted reverse-proxy depth for client-IP extraction (#2453).
+-- Trusted reverse-proxy depth for client-IP extraction.
 --
 -- X-Forwarded-For grows left-to-right: each proxy APPENDS the peer it
 -- received the request from. For client -> CDN -> own-proxy -> Minstrel the
@@ -11,14 +11,15 @@
 --
 -- Default 1: a publicly reachable Minstrel needs a TLS terminator in front of
 -- it, and recording that terminator's own address for every session makes the
--- active-sessions surface (#370) useless — created_ip and last_ip would both
+-- active-sessions surface useless — created_ip and last_ip would both
 -- be the proxy, so the "address changed" signal could never fire.
 --
 -- The cost, stated on the admin card rather than buried: hops >= 1 DECLARES
 -- that a proxy exists. If one doesn't, a client can forge X-Forwarded-For and
 -- choose what its own session row shows, which defeats exactly the compromise
--- detection #370 exists for. That is inherent to the trusted-hop model, which
--- is why 0 is a first-class setting and not a hidden escape hatch.
+-- detection the active-sessions surface exists for. That is inherent to the
+-- trusted-hop model, which is why 0 is a first-class setting and not a hidden
+-- escape hatch.
 --
 -- Upper bound 10 guards a typo turning into "trust the whole header"; no real
 -- deployment chains ten proxies.