refactor(09-05): CODE-09 purge — Phase 8 backend sub-packages (WHAT comments removed)

- api/admin/users.py: removed module docstring + 7 WHAT function docstrings
- api/admin/quotas.py: removed module docstring + 2 WHAT function docstrings
- api/admin/ai.py: removed module docstring + 3 WHAT inline comments; security invariant docstrings preserved
- api/admin/shared.py: unchanged (all comments are WHY — constraint notes)
- api/documents/upload.py: removed 4 WHAT inline comments; T-03-05/T-03-06 WHY notes preserved
- api/documents/content.py: removed WHAT function docstring + WHAT inline comment
- api/documents/crud.py: removed 7 WHAT inline comments; D-16 + security constraint docstrings preserved
- api/auth/shared.py: removed module docstring + 1 WHAT inline comment
- api/auth/tokens.py: removed module docstring + 8 WHAT function docstrings/comments; family-revocation + SEC-02 WHY notes preserved
- api/auth/totp.py: removed module docstring + 2 WHAT function docstrings + 2 WHAT inline comments
- api/auth/password.py: removed module docstring + 2 WHAT function docstrings + 3 WHAT inline comments
- All NO-prefix anchor comments and security-invariant WHY comments preserved
- pytest: 413 passed, 1 failed (pre-existing ModuleNotFoundError unrelated to purge)

backend/api/documents/crud.py

@@ -99,12 +99,10 @@ async def list_documents(
             items.append(d)
         return {"items": items, "total": total, "page": page, "per_page": per_page}
 
-    # New path: direct ORM query with sort/filter/FTS
     from db.models import DocumentTopic, Topic  # noqa: PLC0415 (avoid circular at module top)
 
     stmt = select(Document).where(Document.user_id == current_user.id)
 
-    # Topic filter (join-based, same as list_metadata)
     if topic is not None:
         stmt = (
             stmt.join(DocumentTopic, DocumentTopic.document_id == Document.id)
@@ -112,7 +110,6 @@ async def list_documents(
             .where(Topic.name == topic)
         )
 
-    # Folder filter
     if folder_id is not None:
         try:
             folder_uuid = uuid.UUID(folder_id)
@@ -120,7 +117,6 @@ async def list_documents(
             raise HTTPException(status_code=404, detail="Folder not found")
         stmt = stmt.where(Document.folder_id == folder_uuid)
 
-    # Sort
     sort_col = Document.created_at  # default: date
     if sort == "name":
         sort_col = Document.filename
@@ -147,13 +143,11 @@ async def list_documents(
         result = await session.execute(stmt)
     docs_orm = result.scalars().all()
 
-    # is_shared subquery
     shared_result = await session.execute(
         select(Share.document_id).where(Share.owner_id == current_user.id)
     )
     shared_ids = {row[0] for row in shared_result.fetchall()}
 
-    # Serialize
     all_items = []
     for doc in docs_orm:
         from services.storage import _doc_to_dict, _load_topic_names  # noqa: PLC0415
@@ -199,7 +193,6 @@ async def get_document(
 
     is_recipient = False
     if doc.user_id != current_user.id:
-        # Allow recipients of an active share to view the document
         share_result = await session.execute(
             select(Share).where(
                 Share.document_id == uid,
@@ -250,7 +243,6 @@ async def patch_document(
     if doc is None or doc.user_id != current_user.id:
         raise HTTPException(404, "Document not found")
 
-    # Require at least one field to be set (model_fields_set tracks provided fields)
     if not body.model_fields_set:
         raise HTTPException(422, "At least one field (filename, folder_id) must be provided")
 
@@ -311,7 +303,6 @@ async def delete_document(
     _doc_id = doc.id
     _ip = get_client_ip(request)
 
-    # Cloud routing: attempt provider delete unless remove_only is set
     if is_cloud and not remove_only:
         try:
             import api.documents as _doc_pkg  # late import allows test monkeypatching via api.documents