style: drop redundant comments and apply formatting

Frontend now uses double quotes and semicolons. No behaviour change.

backend/app.py

@@ -21,8 +21,6 @@ def create_app() -> Flask:
         level=logging.INFO, format="%(asctime)s %(levelname)s %(name)s: %(message)s"
     )
     app = Flask(__name__)
-    # Werkzeug buffers and parses the whole body before our validation runs, so unauthenticated
-    # callers could exhaust memory; 1 MiB is far above the largest legitimate payload (10,000-char note).
     app.config["MAX_CONTENT_LENGTH"] = 1024 * 1024
     db.init_app(app)
     auth.init_app(app)
@@ -35,8 +33,6 @@ def create_app() -> Flask:
 
     @app.before_request
     def require_json_for_mutations():
-        # CSRF defense (ADR-0002): cross-site requests can only send this content type after a
-        # CORS preflight, and this API never grants CORS.
         if request.method in MUTATING_METHODS and not request.is_json:
             raise ApiError(
                 400, "Request body must be JSON with Content-Type: application/json"