docs: server comments say what the code does, not how it came to be (#6277)

Comment blocks in cmd/minstrel and 30 smaller internal packages, rewritten
to rule 32's standard with each citation read in context: task, milestone
and rule ids go, and so do the stories they were attached to ("used to",
"Before #N", measurements from one install, quotes, pointers to Fabled
Librarian's records and to docs/superpowers files that are not in the
repo). Where a story wrapped a real constraint, the constraint stays as a
present-tense fact.

Comments that had gone stale are corrected:
- taste.Config: the tuned values are overlaid by internal/recsettings;
  it is no longer "a later follow-up".
- StorageConfig: the data dir holds art, caches and the stream secret,
  not only playlist covers.
- the Subsonic album list and getUser comments describe what they do
  today rather than a milestone that would change it.

Checked: the non-comment token stream of every changed file matches
HEAD, and gofmt -l is empty.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/hygiene.go

@@ -120,8 +120,8 @@ func requireJSONForCookieWrites(next http.Handler) http.Handler {
 // by the SPA handler, which knows the inline-script hashes.
 //
 // HSTS goes out only when the request reached us over HTTPS as the trusted
-// proxy reports it (rule 94): sending it over plain HTTP is ignored by
-// browsers at best, and the app never forces HTTPS.
+// proxy reports it: sent over plain HTTP it is ignored by browsers at best,
+// and the app never forces HTTPS.
 func securityHeaders(hops func() int) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {