refactor(09-05): CODE-09 purge — Phase 8 backend sub-packages (WHAT comments removed)

- api/admin/users.py: removed module docstring + 7 WHAT function docstrings
- api/admin/quotas.py: removed module docstring + 2 WHAT function docstrings
- api/admin/ai.py: removed module docstring + 3 WHAT inline comments; security invariant docstrings preserved
- api/admin/shared.py: unchanged (all comments are WHY — constraint notes)
- api/documents/upload.py: removed 4 WHAT inline comments; T-03-05/T-03-06 WHY notes preserved
- api/documents/content.py: removed WHAT function docstring + WHAT inline comment
- api/documents/crud.py: removed 7 WHAT inline comments; D-16 + security constraint docstrings preserved
- api/auth/shared.py: removed module docstring + 1 WHAT inline comment
- api/auth/tokens.py: removed module docstring + 8 WHAT function docstrings/comments; family-revocation + SEC-02 WHY notes preserved
- api/auth/totp.py: removed module docstring + 2 WHAT function docstrings + 2 WHAT inline comments
- api/auth/password.py: removed module docstring + 2 WHAT function docstrings + 3 WHAT inline comments
- All NO-prefix anchor comments and security-invariant WHY comments preserved
- pytest: 413 passed, 1 failed (pre-existing ModuleNotFoundError unrelated to purge)

backend/api/auth/shared.py

@@ -1,11 +1,3 @@
-"""
-Auth API — shared helpers, Pydantic request models, and the Limiter instance.
-
-This module is imported by every auth sub-module (tokens.py, totp.py, password.py).
-The Limiter instance is re-exported from api/auth/__init__.py so that:
-  from api.auth import limiter
-continues to work in main.py and the 5 test files without modification.
-"""
 from __future__ import annotations
 
 from typing import Literal, Optional
@@ -18,7 +10,6 @@ from config import settings
 from deps.utils import get_client_ip
 
 # IP-level rate limiter (SEC-02 — 10 req/min on register/login/refresh)
-# Re-exported from api/auth/__init__.py via: from api.auth.shared import limiter
 limiter = Limiter(key_func=get_client_ip)