fix(#411): QA-010 — fix minor JSDoc and comment issues across auth files

Fix response.ok JSDoc (2xx not 200), remove stale token refresh claim,
remove non-actionable comment, fix CSRF comment placement, add 403 mapping rationale.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

apps/api/src/auth/auth.config.ts

@@ -210,12 +210,12 @@ export function createAuth(prisma: PrismaClient) {
       provider: "postgresql",
     }),
     emailAndPassword: {
-      enabled: true, // Enable for now, can be disabled later
+      enabled: true,
     },
     plugins: [...getOidcPlugins()],
     session: {
       expiresIn: 60 * 60 * 24 * 7, // 7 days absolute max
-      updateAge: 60 * 60 * 2, // 2 hours idle timeout (sliding window)
+      updateAge: 60 * 60 * 2, // 2 hours — minimum session age before BetterAuth refreshes the expiry on next request
     },
     advanced: {
       defaultCookieAttributes: {