docs: cut the comments that were not earning their place

I wrote 731 comment lines on this branch against 4,530 lines of code — 14%,
where the rest of the repo runs at 1.8%. CLAUDE.md asks for code that reads
like its surroundings, and this did not.

Removed by genre rather than by taste:

- restating the code, e.g. "JS getUTCDay() numbering: Sunday = 0" above the
  map that literally shows it, and a docblock on startOfWeek explaining that
  it returns the start of the week;
- narrating history — "this used to rebuild the whole map", "left the bar
  recording forever" — which the commit message and git blame already carry;
- saying the same thing in several places: the "cannot record is not a
  denied microphone" reason appeared three times in one file, and the
  "aborting stops a per-minute metered call" reason across three files. Each
  now lives once, where the behaviour it explains lives;
- defending decisions nobody would question, like why toLatinDigits is its
  own module;
- over-explaining defensive branches, three separate comments to distinguish
  null from missing-kind from unrecognised-kind.

What stays is what the code cannot say: the patient-right convention in
toFdi, whose failure mode is a valid code for the wrong tooth; the
"this"-vs-"next" week anchoring; StrictMode re-arming mountedRef; Safari
accepting no mimeType hint; and the invariants whose violation already cost
a bug — the body parser's middleware ordering and the dispatch panel's
auto-fill rules.

Comments only. The diff contains no non-comment line.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

backend/src/modules/voice/voice-throttler.guard.ts

@@ -3,15 +3,9 @@ import { ThrottlerGuard } from '@nestjs/throttler';
 import { AppException, ErrorCode } from '../../common/errors';
 
 /**
- * Rate limits voice extraction per user rather than per IP.
- *
- * The default tracker keys on `req.ip`, which behind nginx means the whole deployment
- * shares one bucket unless `trust proxy` is set — and an abuser rotating IPs would bypass
- * it entirely. Since v1 ships with no plan gate, this is the only control on metered
- * vendor spend, so it has to key on something the client cannot change.
- *
- * Guard order matters: the controller's JwtAuthGuard runs before this method-level guard,
- * so `req.user` is populated by the time `getTracker` is called.
+ * Rate limits voice extraction per user, not per IP: the default tracker keys on `req.ip`,
+ * which behind nginx means the whole deployment shares one bucket unless `trust proxy` is
+ * set, and one clinic could then lock out every other.
  */
 @Injectable()
 export class VoiceThrottlerGuard extends ThrottlerGuard {