chore: curatare agresiva comentarii — scoatere referinte US/PRD din cod si template-uri

Eliminat zgomotul de trasabilitate (US-xxx, PRD x.x, Rn, OV-x, Tn, decizii/naratiune
istorica) din 41 fisiere app/ + template-uri. Pastrate comentariile care documenteaza
invarianti si logica ne-evidenta (idempotenta/hash, reconciliere anti-duplicat, RAR 500
esec definitiv, creds per cont, WAF User-Agent, 422 fara echo de parola, scope NULL->1),
curatate doar de tokeni.

Verificare: pentru cele 27 module .py curatate, structura de cod (tokeni non-comentariu/
non-string) e IDENTICA fata de HEAD -> doar comentarii/docstring-uri schimbate. Singura
schimbare de cod e in tests/test_web_responsive.py (scos 3 assert pe markeri US-006/007/008,
inlocuite de asertiunile structurale alaturate). 0 tokeni US/PRD reziduali in app/.
Regresie: 896 passed, 1 deselected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/web/session.py

@@ -1,6 +1,6 @@
-"""Helper-e sesiune web. US-002 PRD 3.3.
+"""Helper-e sesiune web.
 
-Mecanism require_login (C11): NU un dependency FastAPI care intoarce RedirectResponse
+Mecanism require_login: NU un dependency FastAPI care intoarce RedirectResponse
 (acela nu scurtcircuiteaza handler-ul — FastAPI continua executia). In schimb:
 - require_login() RIDICA LoginRequired
 - app.main inregistreaza @app.exception_handler(LoginRequired) care intoarce
@@ -31,7 +31,7 @@ def current_account(request: Request) -> int | None:
 
 
 def current_user_id(request: Request) -> int | None:
-    """user_id din sesiune sau None (C19: leaga import_attestations.confirmed_by)."""
+    """user_id din sesiune sau None (leaga import_attestations.confirmed_by)."""
     val = request.session.get("user_id")
     return int(val) if val is not None else None
 
@@ -88,7 +88,7 @@ def require_admin(request: Request) -> int:
 
 
 def set_session(request: Request, account_id: int, user_id: int) -> None:
-    """Seteaza sesiunea dupa login. Curata mai intai (C3 anti-fixare sesiune)."""
+    """Seteaza sesiunea dupa login. Curata mai intai (anti-fixare sesiune)."""
     request.session.clear()
     request.session["account_id"] = account_id
     request.session["user_id"] = user_id