Cut the comments outside the review-required paths

[sivert-io]

4569 comment lines down to 3089 across src/, minus auth, middleware, db and storage. Those four get their own PR so this one stays readable.

Most of what went was narration: a header restating what the file below it does, or a paragraph on why a design was picked over one nobody proposed. constants/permissions.ts was 57% comment and is now 37%; every permission in the list carried a paragraph and most of them now carry a line.

What stayed

The parts that stop somebody making a change that breaks something.

• The three SVG conditions, in routes/uploads.ts and utils/svgSanitize.ts — what has to remain true for an inline SVG to be safe, including that the sandbox CSP is not optional
• memberStateHash, where a field added to buildMemberList and not to it reaches nobody with nothing erroring (GRYT-65)
• addressIsOwn, where a wrong answer is a LAN open join that admits whoever can reach the proxy
• The invite role rules being applied twice, at creation and at redemption
• The metrics port, and that publishing it puts the Prometheus register back on the internet
• checkSessionAllowed being called before grytUserId is assigned
• lowS: false's equivalent here — parseVersion's closed set of stages, where full semver reads a git describe string as a prerelease

Two stale comments

Nothing found in this repo, unlike crypto. Everything that named a mechanism still names one that exists.

Verification

694 tests pass. The emitted JavaScript is unchanged — I built HEAD and this branch with tsc --removeComments and the output directories are identical.

*.test.ts is left alone. A comment in a test saying why a case exists is close to a test name, and 400-odd more lines would make this diff harder to read for no gain.

What to look at

Whether anything I cut was load-bearing. The headers compressed hardest are moderation/evict.ts, socket/utils/clientNotices.ts and routes/uploadStorage.ts — all three are security reasoning, and all three kept their conclusion and lost the history that led to it. If any of those reads thinner than it should, say so and I will put the sentence back rather than the paragraph.

Part of the comment cleanup tracked under GRYT-899, which stays open. The branch and title are free of the id on purpose: vikunja-task-done.yml reads the branch name and the title, so naming it in either closes the task on merge — which it has done three times already.

🤖 Generated with Claude Code