refactor(09-05): CODE-09 purge — Phase 9 files (WHAT comments removed)

Frontend: AdminLayout, AdminSidebar, AdminOverviewView, AdminUsersView,
AdminQuotasView, AdminAiView, AdminAuditView, router/index.js, LoginView,
tailwind.config.js, api/admin.js — WHAT labels stripped; WHY constraints
preserved (D-16 anchors, security notes, api_key write-only invariant,
router guard rationale, D-08/D-09/D-10 decision refs, fetchWithRetry reason).
Backend: overview.py was already clean (no WHAT comments present).
Frontend: 137 tests pass, build succeeds.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/api/admin.js

@@ -1,10 +1,3 @@
-/**
- * Admin API — user management, quota, AI config, audit log, daily exports.
- *
- * Consumers: AdminUsersView.vue, AdminQuotasView.vue, AdminAiView.vue,
- *            AdminAuditView.vue
- */
-
 import { request, fetchWithRetry } from './utils.js'
 
 export function adminListUsers() {
@@ -104,17 +97,8 @@ export function adminListAuditLog({ start, end, user_handle, event_type, page =
   return request(`/api/admin/audit-log?${params}`)
 }
 
-/**
- * Export the audit log as a CSV file using fetch + Blob URL.
- *
- * Unlike window.location.href, this sends the Authorization Bearer header so
- * the endpoint can authenticate the request (D-13, T-06.2-04-03).
- *
- * Refactored to use fetchWithRetry() — the retry boilerplate is consolidated
- * in utils.js (CODE-08).
- *
- * Must NOT call res.json() — CSV is text/csv.
- */
+// Unlike window.location.href, fetchWithRetry sends the Authorization Bearer header so
+// the endpoint can authenticate. Must NOT call res.json() — CSV is text/csv.
 export async function adminExportAuditLogCsv(params = {}) {
   const searchParams = new URLSearchParams({ format: 'csv' })
   if (params.start) searchParams.set('start', params.start)
@@ -145,14 +129,7 @@ export async function getAdminOverview() {
   return request('/api/admin/overview')
 }
 
-/**
- * Download a specific Celery daily audit export file from MinIO using fetch + Blob URL.
- *
- * Uses fetchWithRetry() to send the Authorization Bearer header (D-17, T-06.2-04-03).
- * Refactored to use fetchWithRetry() — retry logic consolidated in utils.js (CODE-08).
- *
- * @param {string} date — YYYY-MM-DD format date string
- */
+// Uses fetchWithRetry() to send the Authorization Bearer header (D-17, T-06.2-04-03).
 export async function adminDownloadDailyExport(date) {
   const res = await fetchWithRetry(`/api/admin/audit-log/daily-exports/${date}`)
   if (!res.ok) throw new Error(`Download failed: ${res.status}`)