fix(#411): QA-010 — fix minor JSDoc and comment issues across auth files

Fix response.ok JSDoc (2xx not 200), remove stale token refresh claim,
remove non-actionable comment, fix CSRF comment placement, add 403 mapping rationale.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/api/src/auth/auth.service.ts

@@ -153,7 +153,7 @@ export class AuthService {
    * Check if the OIDC provider (Authentik) is reachable by fetching the discovery URL.
    * Results are cached for 30 seconds to prevent repeated network calls.
    *
-   * @returns true if the provider responds with HTTP 200, false otherwise
+   * @returns true if the provider responds with an HTTP 2xx status, false otherwise
    */
   async isOidcProviderReachable(): Promise<boolean> {
     const now = Date.now();