[SandObserver]

Summary

• Apply the comment policy across api/, ui/, e2e/, scripts/ and nginx/: delete comments that restate the code, narrate a past defect, or explain a design choice, and rewrite the survivors as a short statement of the constraint.
• Keep the security and data-loss constraints (SSRF boundary and rewrite ordering, secret scoping and scrubbing, null prototypes on config-keyed objects, log-injection quoting, config write durability, the <img src> icon invariant, the escape-by-default markup rules) as one- or two-sentence notes.
• Strip regression-narrative headers and per-test rationale from the API and UI test suites, leaving section banners and assertion messages intact.
• Trim connective prose from docs/*.md, CONTRIBUTING.md and SECURITY.md without dropping facts, commands, tables or links.
• No code, formatting or test assertion is changed.

Testing
All green, apart from the Docker build smoke test, which has no local Docker and is left to CI. No coverage change: no new logic.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.
• CHANGELOG.md updated under Unreleased if the change is user-visible.