refactor(09-05): CODE-09 purge — Phase 8 backend sub-packages (WHAT comments removed)

- api/admin/users.py: removed module docstring + 7 WHAT function docstrings
- api/admin/quotas.py: removed module docstring + 2 WHAT function docstrings
- api/admin/ai.py: removed module docstring + 3 WHAT inline comments; security invariant docstrings preserved
- api/admin/shared.py: unchanged (all comments are WHY — constraint notes)
- api/documents/upload.py: removed 4 WHAT inline comments; T-03-05/T-03-06 WHY notes preserved
- api/documents/content.py: removed WHAT function docstring + WHAT inline comment
- api/documents/crud.py: removed 7 WHAT inline comments; D-16 + security constraint docstrings preserved
- api/auth/shared.py: removed module docstring + 1 WHAT inline comment
- api/auth/tokens.py: removed module docstring + 8 WHAT function docstrings/comments; family-revocation + SEC-02 WHY notes preserved
- api/auth/totp.py: removed module docstring + 2 WHAT function docstrings + 2 WHAT inline comments
- api/auth/password.py: removed module docstring + 2 WHAT function docstrings + 3 WHAT inline comments
- All NO-prefix anchor comments and security-invariant WHY comments preserved
- pytest: 413 passed, 1 failed (pre-existing ModuleNotFoundError unrelated to purge)

backend/api/auth/totp.py

@@ -1,11 +1,3 @@
-"""
-Auth API — TOTP endpoints.
-
-Handles:
-  GET    /totp/setup   — provision TOTP secret for current user
-  POST   /totp/enable  — enable TOTP (verify code, generate backup codes)
-  DELETE /totp         — disable TOTP (clear secret, revoke other sessions)
-"""
 from __future__ import annotations
 
 import hashlib
@@ -34,12 +26,6 @@ async def totp_setup(
     session: AsyncSession = Depends(get_db),
     current_user: User = Depends(get_current_user),
 ):
-    """Provision a TOTP secret for the current user.
-
-    If TOTP is already enabled, returns 400.
-    Returns { provisioning_uri, secret } — the provisioning_uri is suitable
-    for QR code generation. The secret is the base32-encoded TOTP secret.
-    """
     if current_user.totp_enabled:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
@@ -59,14 +45,7 @@ async def enable_totp(
     session: AsyncSession = Depends(get_db),
     current_user: User = Depends(get_current_user),
 ):
-    """Enable TOTP for the current user.
-
-    Rate-limited to 10 attempts/minute per IP (SEC-02 / T-02-25).
-    Verifies the submitted 6-digit code (with Redis replay prevention, AUTH-08).
-    On success: marks TOTP enabled, generates and returns 10 one-time backup codes.
-    The backup codes are ONLY returned here — they are stored as Argon2 hashes
-    in the DB and never returned again (T-02-19).
-    """
+    # Backup codes are returned here ONLY — stored as Argon2 hashes, never returned again (T-02-19)
     redis_client = request.app.state.redis
     ok = await auth_service.verify_totp(session, current_user.id, body.code, redis_client)
     if not ok:
@@ -75,12 +54,10 @@ async def enable_totp(
             detail="Incorrect or expired code",
         )
 
-    # Mark TOTP as enabled
     user = await session.get(User, current_user.id)
     user.totp_enabled = True
     await session.flush()
 
-    # Generate and store 10 backup codes; return plaintext to user (one-time, T-02-19)
     plain_codes = auth_service.generate_backup_codes(10)
     await auth_service.store_backup_codes(session, current_user.id, plain_codes)
 
@@ -119,16 +96,11 @@ async def disable_totp(
     session: AsyncSession = Depends(get_db),
     current_user: User = Depends(get_current_user),
 ):
-    """Disable TOTP for the current user.
-
-    Clears totp_secret, sets totp_enabled=False, and deletes all backup codes.
-    """
     _ip = get_client_ip(request)
     user = await session.get(User, current_user.id)
     user.totp_enabled = False
     user.totp_secret = None
 
-    # Delete all backup codes for this user (including unused ones)
     await session.execute(delete(BackupCode).where(BackupCode.user_id == current_user.id))
 
     # Revoke other sessions; keep current one alive via skip_token_hash (CR-03)