refactor(09-05): CODE-09 purge — Phase 8 backend sub-packages (WHAT comments removed)

- api/admin/users.py: removed module docstring + 7 WHAT function docstrings
- api/admin/quotas.py: removed module docstring + 2 WHAT function docstrings
- api/admin/ai.py: removed module docstring + 3 WHAT inline comments; security invariant docstrings preserved
- api/admin/shared.py: unchanged (all comments are WHY — constraint notes)
- api/documents/upload.py: removed 4 WHAT inline comments; T-03-05/T-03-06 WHY notes preserved
- api/documents/content.py: removed WHAT function docstring + WHAT inline comment
- api/documents/crud.py: removed 7 WHAT inline comments; D-16 + security constraint docstrings preserved
- api/auth/shared.py: removed module docstring + 1 WHAT inline comment
- api/auth/tokens.py: removed module docstring + 8 WHAT function docstrings/comments; family-revocation + SEC-02 WHY notes preserved
- api/auth/totp.py: removed module docstring + 2 WHAT function docstrings + 2 WHAT inline comments
- api/auth/password.py: removed module docstring + 2 WHAT function docstrings + 3 WHAT inline comments
- All NO-prefix anchor comments and security-invariant WHY comments preserved
- pytest: 413 passed, 1 failed (pre-existing ModuleNotFoundError unrelated to purge)

backend/api/documents/upload.py

@@ -129,7 +129,6 @@ async def upload_document(
     """
     request.state.current_user = current_user
     if target_backend == "minio":
-        # MinIO: generate a presigned URL for client-side PUT (existing flow reused)
         doc_id = uuid.uuid4()
         suffix = Path(file.filename or "file").suffix.lower()
         object_key = f"{current_user.id}/{doc_id}/{uuid.uuid4()}{suffix}"
@@ -152,7 +151,6 @@ async def upload_document(
         )
         return {"upload_url": upload_url, "document_id": str(doc_id)}
 
-    # Cloud backend path
     if target_backend not in _CLOUD_PROVIDERS:
         raise HTTPException(
             status_code=422,
@@ -174,11 +172,9 @@ async def upload_document(
             detail=f"No active {target_backend} connection found. Please connect in Settings.",
         )
 
-    # Decrypt per-user credentials
     master_key = settings.cloud_creds_key.encode()
     credentials = decrypt_credentials(master_key, str(current_user.id), conn.credentials_enc)
 
-    # Read file bytes
     file_bytes = await file.read()
     filename = file.filename or "upload"
     content_type = file.content_type or "application/octet-stream"
@@ -186,7 +182,6 @@ async def upload_document(
 
     doc_id = uuid.uuid4()
 
-    # Instantiate backend and upload
     if target_backend == "google_drive":
         from storage.google_drive_backend import GoogleDriveBackend  # lazy import
         cloud_backend = GoogleDriveBackend(credentials)
@@ -319,13 +314,11 @@ async def confirm_upload(
     row = result.fetchone()
 
     if row is None:
-        # Quota exceeded — fetch current quota state for the 413 body
         quota_result = await session.execute(
             text("SELECT used_bytes, limit_bytes FROM quotas WHERE user_id = :uid"),
             {"uid": doc.user_id.hex},
         )
         q = quota_result.fetchone()
-        # Delete the pending Document row and best-effort remove the MinIO object
         await session.delete(doc)
         try:
             await get_storage_backend().delete_object(doc.object_key)