chore: comment cleanup pass ahead of open-sourcing

Removes leftover debug scaffolding (stray Console.WriteLine/NSLog traces,
dead nick_buf_ptr, a no-op --print-config flag now implemented for real),
fixes stale/misleading comments (channel passwords are no longer a "future
M5+" feature, a wrong cross-reference, a stale TlsContext::close() mention,
an incomplete BanRecord::subject_type doc, and a smoke test pointing at a
build/m1-dev preset that no longer exists), strips internal M1-M5 milestone
jargon from comments now that the roadmap is done, trims comments that just
restated the following line, and consolidates a few "why" explanations that
were duplicated 2-3 times in the same file.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

core/include/voicecat.h

@@ -8,9 +8,8 @@
  * Design: docs/architecture.md §4. Everything here is async + event-driven — calls return
  * immediately and results/state changes arrive via the vc_callbacks.on_event callback.
  *
- * STATUS: real. Control plane, voice, multi-stream, device enumeration, VAD/PTT, and stereo
- * playback all work via core/src/core/client.cpp. webrtc AEC/NS/AGC remains an inert passthrough
- * (no Windows/MSVC port upstream — docs/voice.md §8/§11, PROGRESS.md).
+ * webrtc AEC/NS/AGC remains an inert passthrough (no Windows/MSVC port upstream — see
+ * docs/voice.md §8/§11).
  */
 #ifndef VOICECAT_H
 #define VOICECAT_H
@@ -81,7 +80,7 @@ typedef enum vc_connection_state {
     VC_STATE_TLS_HANDSHAKE = 2,
     VC_STATE_AUTHENTICATING = 3,
     VC_STATE_CONNECTED = 4,
-    /* M4: between TLS_HANDSHAKE and AUTHENTICATING — the handshake succeeded and the core is
+    /* Between TLS_HANDSHAKE and AUTHENTICATING — the handshake succeeded and the core is
      * waiting for vc_confirm_server_identity() (see VC_EVENT_SERVER_IDENTITY below). Appended
      * at the end (not inserted) to keep existing enum values stable — additive-only ABI. */
     VC_STATE_VERIFYING_IDENTITY = 5,
@@ -125,7 +124,7 @@ typedef enum vc_event_type {
     VC_EVENT_TALK_STATE = 9,       /* user_id, stream_id, u32a = talking(0/1) */
     VC_EVENT_ERROR = 10,           /* result, text */
     VC_EVENT_DISCONNECTED = 11,    /* result, text = reason */
-    /* M4 additions — appended, not inserted, to keep existing enum values stable. */
+    /* Appended, not inserted, to keep existing enum values stable. */
     VC_EVENT_JOIN_RESULT = 12,     /* result (VC_OK/VC_ERR_*), channel_id, text = error on
                                        failure. Reply to vc_join_channel(). */
     VC_EVENT_SERVER_IDENTITY = 13, /* u32a = vc_tofu_status, text = hex-encoded TLS leaf-cert
@@ -134,7 +133,7 @@ typedef enum vc_event_type {
                                        attempt, right after the TLS handshake succeeds. The
                                        connection is held open until vc_confirm_server_identity()
                                        is called. */
-    /* M5 additions — appended, not inserted. */
+    /* Appended, not inserted. */
     VC_EVENT_GENERIC_RESULT = 14,  /* result, u32a = server error code, text = message. Reply
                                        to vc_kick_user/vc_ban_user/vc_set_permission/
                                        vc_move_user/vc_create_channel/vc_edit_channel/
@@ -147,7 +146,7 @@ typedef enum vc_event_type {
                                        (vc_user) carries per-user voice_subscribed. */
 } vc_event_type;
 
-/* TOFU server-identity classification (M4) — see VC_EVENT_SERVER_IDENTITY and
+/* TOFU server-identity classification — see VC_EVENT_SERVER_IDENTITY and
  * vc_confirm_server_identity. Pins the TLS leaf certificate's own SHA-256 fingerprint
  * (verifiable directly from the handshake), NOT the declared Ed25519
  * server_identity_fingerprint from ServerHello — the TLS cert and the server's Ed25519
@@ -194,7 +193,7 @@ typedef struct vc_config {
     const char* client_name;    /* e.g. "VoiceCat-macOS" */
     const char* client_version; /* e.g. "0.0.1" */
     vc_log_level log_level;
-    /* M4, optional (added at the end — existing brace-initialized callers default this to
+    /* Optional (added at the end — existing brace-initialized callers default this to
      * NULL, no source change needed). Path to the TOFU pin file (see VC_EVENT_SERVER_IDENTITY/
      * vc_confirm_server_identity). NULL = a built-in relative default
      * ("./voicecat_tofu_pins.txt") so existing tests need no real persistence. A real app
@@ -232,7 +231,7 @@ typedef struct vc_audio_config {
     int      dred;                 /* bool — Deep REDundancy (Opus 1.6), off by default */
 } vc_audio_config;
 
-/* M5: permission bitset (mirrors protocol Permissions). */
+/* Permission bitset (mirrors protocol Permissions). */
 typedef struct vc_permissions {
     int can_create_temp_channel; /* bool */
     int can_kick;                /* bool */
@@ -242,7 +241,7 @@ typedef struct vc_permissions {
     int is_admin;                /* bool */
 } vc_permissions;
 
-/* M5: account entry (reply to vc_list_accounts / vc_get_account_list). */
+/* Account entry (reply to vc_list_accounts / vc_get_account_list). */
 typedef struct vc_account {
     const char* username;
     int         is_admin;            /* bool */
@@ -255,7 +254,7 @@ typedef struct vc_account_list {
     size_t      count;
 } vc_account_list;
 
-/* M5: channel creation/edition descriptor. */
+/* Channel creation/edition descriptor. */
 typedef struct vc_channel_info {
     uint32_t id;                  /* 0 = new channel for create */
     uint32_t parent_id;           /* 0 = root */
@@ -280,7 +279,7 @@ typedef struct vc_device_list {
     size_t count;
 } vc_device_list;
 
-/* ── Channel / user / stream snapshots (M4 — for the channel-tree/user-list UI) ───────────
+/* ── Channel / user / stream snapshots (for the channel-tree/user-list UI) ────────────────
  * Pull-based: re-call after VC_EVENT_CHANNEL_LIST / VC_EVENT_USER_JOINED / _LEFT / _UPDATED to
  * refresh — there is no push variant; those events just mean "go look". Same ownership
  * contract as vc_device/vc_device_list above: core-allocated, caller frees with the matching
@@ -363,10 +362,8 @@ VC_API vc_result vc_authenticate_user(vc_client* c, const char* username,
 
 /* ── Channels ─────────────────────────────────────────────────────────────── */
 /* Result arrives as VC_EVENT_JOIN_RESULT, not a return value beyond "request queued". `password`
- * is forwarded to the server's JoinChannelRequest.password for channels with
- * vc_channel.password_protected set; NOTE (M4): no in-tree channel currently has a server-side
- * password to check against — channel creation/passwords are a future (M5+) feature, so this
- * path is wired but not yet exercisable end-to-end. */
+ * is forwarded to the server's JoinChannelRequest.password and checked against the channel's
+ * stored password for channels with vc_channel.password_protected set. */
 VC_API vc_result vc_join_channel(vc_client* c, uint32_t channel_id,
                                  const char* password /* nullable */);
 VC_API vc_result vc_leave_channel(vc_client* c);
@@ -468,7 +465,7 @@ VC_API vc_result vc_set_capture_channels(vc_client* c, uint32_t stream_id, uint3
  * music / relay), soundboards, DAW integration. Works for any stream kind (MIC /
  * SCREEN_AUDIO / AUX_DEVICE). Thread-safe; may be called from any thread.
  *
- * Replaces vc_test_inject_capture (deprecated alias, see below). */
+ * Replaces vc_test_inject_capture (deprecated alias, see above). */
 VC_API vc_result vc_stream_feed_pcm(vc_client* c, uint32_t stream_id,
                                     const int16_t* pcm, size_t samples_per_channel,
                                     uint32_t channels);
@@ -538,7 +535,7 @@ VC_API vc_result vc_send_text(vc_client* c, vc_text_scope scope, uint32_t target
 VC_API vc_result vc_list_devices(vc_client* c, vc_device_kind kind, vc_device_list* out);
 VC_API void vc_free_device_list(vc_device_list* list);
 
-/* ── Channel / user / stream enumeration (M4; mirrors vc_list_devices above) ─────────────── */
+/* ── Channel / user / stream enumeration (mirrors vc_list_devices above) ──────────────────── */
 VC_API vc_result vc_list_channels(vc_client* c, vc_channel_list* out);
 VC_API void      vc_free_channel_list(vc_channel_list* list);
 
@@ -551,7 +548,7 @@ VC_API vc_result vc_list_user_streams(vc_client* c, uint32_t user_id,
                                       vc_stream_summary_list* out);
 VC_API void      vc_free_stream_summary_list(vc_stream_summary_list* list);
 
-/* ── TOFU server-identity confirmation (M4) — see VC_EVENT_SERVER_IDENTITY/vc_tofu_status ── */
+/* ── TOFU server-identity confirmation — see VC_EVENT_SERVER_IDENTITY/vc_tofu_status ──────── */
 /* Accept or reject the pending server-identity check for the in-progress connect(). Must be
  * called after a VC_EVENT_SERVER_IDENTITY event; the io_thread_ holds the connection open
  * (ClientHello/auth deferred) until this is called, up to a generous internal timeout (after
@@ -570,7 +567,7 @@ VC_API vc_result vc_confirm_server_identity(vc_client* c, int accept /* bool */)
 VC_API vc_result vc_get_server_identity_display(vc_client* c, char* out_buf, size_t buf_cap,
                                                  size_t* out_len);
 
-/* ── M5: Moderation & admin ─────────────────────────────────────────────────
+/* ── Moderation & admin ───────────────────────────────────────────────────────
  * All calls are async; the result arrives as VC_EVENT_GENERIC_RESULT (or
  * VC_EVENT_ACCOUNT_LIST for vc_list_accounts). They require VC_STATE_CONNECTED and,
  * on the server side, the appropriate permission. */