docs: server comments say what the code does, not how it came to be (#6277)

Comment blocks in cmd/minstrel and 30 smaller internal packages, rewritten
to rule 32's standard with each citation read in context: task, milestone
and rule ids go, and so do the stories they were attached to ("used to",
"Before #N", measurements from one install, quotes, pointers to Fabled
Librarian's records and to docs/superpowers files that are not in the
repo). Where a story wrapped a real constraint, the constraint stays as a
present-tense fact.

Comments that had gone stale are corrected:
- taste.Config: the tuned values are overlaid by internal/recsettings;
  it is no longer "a later follow-up".
- StorageConfig: the data dir holds art, caches and the stream secret,
  not only playlist covers.
- the Subsonic album list and getUser comments describe what they do
  today rather than a milestone that would change it.

Checked: the non-comment token stream of every changed file matches
HEAD, and gofmt -l is empty.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/auth/clientip.go

@@ -7,7 +7,7 @@ import (
 )
 
 // ClientIP returns the caller's address, reading through trustedProxyHops
-// reverse proxies (#2453).
+// reverse proxies.
 //
 // X-Forwarded-For grows left-to-right: every proxy APPENDS the peer it
 // received the request from. For client -> CDN -> own-proxy -> Minstrel the
@@ -20,13 +20,12 @@ import (
 //	           honestly claim is the address it told us about
 //	hops 2  -> XFF[0] = client
 //
-// This replaces an earlier heuristic that ignored XFF whenever RemoteAddr was
-// public. That was safe but useless in the deployment that matters: a proxy
-// on a public address (separate host, or a CDN) meant every session recorded
-// the proxy, so the active-sessions surface could never show an address
-// change (#370).
+// Ignoring XFF whenever RemoteAddr is public would be safe but useless: behind
+// a proxy on a public address (a separate host, or a CDN) every session would
+// record the proxy, and the active-sessions list could never show an address
+// change.
 //
-// # What the operator is asserting
+// # What the hop count asserts
 //
 // hops >= 1 is a DECLARATION that a proxy sits in front. Two ways to get it
 // wrong, both worth understanding rather than papering over:
@@ -36,9 +35,9 @@ import (
 //   - Set HIGHER than the real chain: the index runs past the proxy-written
 //     entries into attacker-supplied ones, same result.
 //
-// Both are inherent to the trusted-hop model — Rails, Caddy, Traefik and
-// nginx all behave this way — which is why 0 is a first-class value and the
-// admin card tells the operator to count their proxies.
+// Both are inherent to the trusted-hop model (Rails, Caddy, Traefik and nginx
+// behave the same way), which is why 0 is the default and the admin card asks
+// for the number of proxies in front.
 func ClientIP(r *http.Request, trustedProxyHops int) string {
 	remote := hostOf(r.RemoteAddr)
 	if trustedProxyHops <= 0 {
@@ -51,7 +50,7 @@ func ClientIP(r *http.Request, trustedProxyHops int) string {
 		return remote
 	}
 	// Clamp rather than reject: a chain shorter than the configured depth
-	// means the operator over-counted, and the leftmost entry is the closest
+	// means the hops were over-counted, and the leftmost entry is the closest
 	// thing to a client on offer. The caveat above covers the risk.
 	idx := len(chain) - trustedProxyHops
 	if idx < 0 {
@@ -68,8 +67,8 @@ func ClientIP(r *http.Request, trustedProxyHops int) string {
 // IsHTTPS reports whether the client reached us over HTTPS, reading through
 // trustedProxyHops reverse proxies by the same rule as ClientIP.
 //
-// TLS terminates at the operator's proxy (rule 94), so r.TLS is nil in every
-// real deployment and only X-Forwarded-Proto can say what the client used.
+// TLS terminates at the reverse proxy, so r.TLS is nil in every real
+// deployment and only X-Forwarded-Proto can say what the client used.
 // That header is believed only when hops >= 1: with no trusted proxy it is
 // just something any client can send. Proxies that append rather than
 // overwrite produce a comma list, read positionally like X-Forwarded-For.