refactor(09-05): CODE-09 purge — Phase 8 backend sub-packages (WHAT comments removed)

- api/admin/users.py: removed module docstring + 7 WHAT function docstrings
- api/admin/quotas.py: removed module docstring + 2 WHAT function docstrings
- api/admin/ai.py: removed module docstring + 3 WHAT inline comments; security invariant docstrings preserved
- api/admin/shared.py: unchanged (all comments are WHY — constraint notes)
- api/documents/upload.py: removed 4 WHAT inline comments; T-03-05/T-03-06 WHY notes preserved
- api/documents/content.py: removed WHAT function docstring + WHAT inline comment
- api/documents/crud.py: removed 7 WHAT inline comments; D-16 + security constraint docstrings preserved
- api/auth/shared.py: removed module docstring + 1 WHAT inline comment
- api/auth/tokens.py: removed module docstring + 8 WHAT function docstrings/comments; family-revocation + SEC-02 WHY notes preserved
- api/auth/totp.py: removed module docstring + 2 WHAT function docstrings + 2 WHAT inline comments
- api/auth/password.py: removed module docstring + 2 WHAT function docstrings + 3 WHAT inline comments
- All NO-prefix anchor comments and security-invariant WHY comments preserved
- pytest: 413 passed, 1 failed (pre-existing ModuleNotFoundError unrelated to purge)

backend/api/admin/ai.py

@@ -1,12 +1,3 @@
-"""Admin AI configuration endpoints.
-
-Handles: get_ai_config_models, test_ai_connection, get_ai_config, update_system_ai_config.
-
-All handlers require get_current_admin (SEC-07, T-08-04-01).
-Sub-router has NO prefix — parent __init__.py carries /api/admin (D-04).
-
-_ai_config_to_dict is local to this module (only ai.py uses it — not in shared.py).
-"""
 from __future__ import annotations
 
 from typing import Optional
@@ -126,7 +117,7 @@ async def get_ai_config_models(
 
     api_key = config.api_key if config else ""
 
-    # Build request headers — Anthropic uses x-api-key; all others use Bearer
+    # Anthropic uses x-api-key; all others use Bearer (different auth schemes)
     if provider_id == "anthropic":
         headers = {
             "x-api-key": api_key,
@@ -143,9 +134,6 @@ async def get_ai_config_models(
             resp.raise_for_status()
             data = resp.json()
 
-        # Standard OpenAI-compat shape: {"data": [{"id": "...", ...}, ...]}
-        # Anthropic shape: {"data": [{"id": "...", ...}, ...]}
-        # Ollama OpenAI-compat: same shape
         raw_list = data.get("data") or data.get("models") or []
         model_ids: list[str] = sorted(
             {
@@ -286,7 +274,6 @@ async def update_system_ai_config(
     """
     from config import settings as _settings  # noqa: PLC0415
 
-    # Load existing row or create a new one from PROVIDER_DEFAULTS
     stmt = select(SystemSettings).where(SystemSettings.provider_id == body.provider_id)
     result = await session.execute(stmt)
     row = result.scalar_one_or_none()
@@ -303,10 +290,8 @@ async def update_system_ai_config(
             api_key_enc=None,
         )
 
-    # Track which fields the caller explicitly set (for audit log — never api_key value)
     fields_changed: list[str] = []
 
-    # Apply provided fields
     if body.api_key is not None:
         fields_changed.append("api_key")
         if body.api_key == "":
@@ -363,7 +348,6 @@ async def update_system_ai_config(
 
     await session.commit()
 
-    # Reload to pick up DB-generated updated_at after commit
     await session.refresh(row)
 
     return _ai_config_to_dict(row)