refactor(09-05): CODE-09 purge — Phase 8 backend sub-packages (WHAT comments removed)

- api/admin/users.py: removed module docstring + 7 WHAT function docstrings
- api/admin/quotas.py: removed module docstring + 2 WHAT function docstrings
- api/admin/ai.py: removed module docstring + 3 WHAT inline comments; security invariant docstrings preserved
- api/admin/shared.py: unchanged (all comments are WHY — constraint notes)
- api/documents/upload.py: removed 4 WHAT inline comments; T-03-05/T-03-06 WHY notes preserved
- api/documents/content.py: removed WHAT function docstring + WHAT inline comment
- api/documents/crud.py: removed 7 WHAT inline comments; D-16 + security constraint docstrings preserved
- api/auth/shared.py: removed module docstring + 1 WHAT inline comment
- api/auth/tokens.py: removed module docstring + 8 WHAT function docstrings/comments; family-revocation + SEC-02 WHY notes preserved
- api/auth/totp.py: removed module docstring + 2 WHAT function docstrings + 2 WHAT inline comments
- api/auth/password.py: removed module docstring + 2 WHAT function docstrings + 3 WHAT inline comments
- All NO-prefix anchor comments and security-invariant WHY comments preserved
- pytest: 413 passed, 1 failed (pre-existing ModuleNotFoundError unrelated to purge)

backend/api/documents/content.py

@@ -62,19 +62,6 @@ async def stream_document_content(
     session: AsyncSession = Depends(get_db),
     current_user: User = Depends(get_regular_user),
 ):
-    """Stream document bytes directly from MinIO (DOC-02).
-
-    T-04-05-01: uses get_regular_user — admin role → 403 (critical security invariant).
-    T-04-05-02: bytes fetched via get_object() ONLY — presigned_get_url() never called.
-    T-04-05-03: Range header validated via _parse_range(); invalid range → 416.
-    T-04-05-04: access gated on ownership OR active Share.recipient_id.
-
-    Returns 200 (or 206 for Range requests) with:
-      Content-Type: doc.content_type
-      Content-Disposition: inline; filename="<filename>"
-      Accept-Ranges: bytes
-      Content-Length: <size>
-    """
     request.state.current_user = current_user
     try:
         uid = uuid.UUID(doc_id)
@@ -97,9 +84,6 @@ async def stream_document_content(
         if share is None:
             raise HTTPException(status_code=404, detail="Document not found")
 
-    # Fetch bytes from the correct backend — get_storage_backend_for_document handles
-    # all backends (MinIO, Google Drive, OneDrive, Nextcloud, WebDAV) transparently
-    # (D-15, T-04-05-02). NEVER via presigned URL for cloud backends (D-14).
     try:
         import api.documents as _doc_pkg  # late import allows test monkeypatching via api.documents
         storage_backend = await _doc_pkg.get_storage_backend_for_document(doc, current_user, session)