docs: server comments say what the code does, not how it came to be (#6277)

Comment blocks in cmd/minstrel and 30 smaller internal packages, rewritten
to rule 32's standard with each citation read in context: task, milestone
and rule ids go, and so do the stories they were attached to ("used to",
"Before #N", measurements from one install, quotes, pointers to Fabled
Librarian's records and to docs/superpowers files that are not in the
repo). Where a story wrapped a real constraint, the constraint stays as a
present-tense fact.

Comments that had gone stale are corrected:
- taste.Config: the tuned values are overlaid by internal/recsettings;
  it is no longer "a later follow-up".
- StorageConfig: the data dir holds art, caches and the stream secret,
  not only playlist covers.
- the Subsonic album list and getUser comments describe what they do
  today rather than a milestone that would change it.

Checked: the non-comment token stream of every changed file matches
HEAD, and gofmt -l is empty.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/auth/session.go

@@ -68,8 +68,8 @@ const SessionCookieName = "minstrel_session"
 // leak whether the username existed (matches the /rest/* auth posture).
 //
 // trustedHops supplies the reverse-proxy depth used to record the session's
-// current address (#2453). It's a func rather than an int because the value
-// is operator-editable at runtime and this middleware is constructed once at
+// current address. It's a func rather than an int because the value
+// is editable at runtime and this middleware is constructed once at
 // boot — reading it per request is what makes an admin change take effect
 // without a restart. Passing nil means "trust nothing", i.e. the socket peer.
 func RequireUser(pool *pgxpool.Pool, trustedHops func() int) func(http.Handler) http.Handler {
@@ -155,7 +155,7 @@ func SessionIDCtxKeyForTest() any { return sessionIDCtxKey }
 //
 // Database lookup failures fall through too — a transient DB blip should not
 // 5xx a stream request that may have a perfectly valid signed token. The
-// error is logged so the operator can correlate.
+// error is logged so it can be correlated.
 func OptionalUser(pool *pgxpool.Pool, logger *slog.Logger) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {