chore: remove finding-ID prefixes from code comments

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

app/api/instances/sync/route.ts

@@ -202,7 +202,7 @@ function isL4ProxyHost(value: unknown): value is NonNullable<SyncPayload["data"]
 }
 
 /**
- * H8: Validate semantic content of proxy host fields to prevent
+ * Validate semantic content of proxy host fields to prevent
  * config injection via compromised master or stolen sync token.
  */
 function validateProxyHostContent(host: Record<string, unknown>): string | null {
@@ -341,7 +341,7 @@ export async function POST(request: NextRequest) {
     return NextResponse.json({ error: "Invalid sync payload structure" }, { status: 400 });
   }
 
-  // H8: Semantic validation of proxy host content
+  // Semantic validation of proxy host content
   for (const host of (payload as SyncPayload).data.proxyHosts) {
     const err = validateProxyHostContent(host as unknown as Record<string, unknown>);
     if (err) {

app/api/user/change-password/route.ts

@@ -15,7 +15,7 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
     }
 
-    // M3: Rate limit password change attempts to prevent brute-forcing current password
+    // Rate limit password change attempts to prevent brute-forcing current password
     const rateLimitKey = `password-change:${session.user.id}`;
     const rateCheck = isRateLimited(rateLimitKey);
     if (rateCheck.blocked) {
@@ -28,7 +28,7 @@ export async function POST(request: NextRequest) {
     const body = await request.json();
     const { currentPassword, newPassword } = body;
 
-    // L4: Enforce password complexity matching production admin password requirements
+    // Enforce password complexity matching production admin password requirements
     if (!newPassword || newPassword.length < 12) {
       return NextResponse.json(
         { error: "New password must be at least 12 characters long" },

app/api/v1/tokens/route.ts

@@ -21,7 +21,7 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: "name is required" }, { status: 400 });
     }
 
-    // C3: Validate expires_at before passing to createApiToken
+    // Validate expires_at before passing to createApiToken
     if (body.expires_at !== undefined && body.expires_at !== null && typeof body.expires_at !== "string") {
       return NextResponse.json({ error: "expires_at must be a string (ISO 8601 date)" }, { status: 400 });
     }