chore(auth): remove security plan doc and marker comments

index.js

@@ -72,7 +72,6 @@ const { authRateLimiter } = require('./middleware/authRateLimiter');
  *       400:
  *         description: Bad request.
  */
-// SECURITY FIX (#2): POST-only signup to avoid query-string credential leakage.
 app.post('/signup', signup);
 /**
  * @swagger
@@ -106,7 +105,6 @@ app.post('/signup', signup);
  *       401:
  *         description: Invalid credentials.
  */
-// SECURITY FIX (#2): POST-only login to avoid query-string credential leakage.
 app.post('/login', authRateLimiter('login'), login);
 /**
  * @swagger
@@ -156,8 +154,6 @@ app.get('/logout', logout);
  *         description: Bad request.
  */
 app.route('/resetPassword').post(authRateLimiter('reset'), resetPassword);
-// SECURITY FIX (#1):
-// Single-use token login endpoint for password recovery flow.
 /**
  * @swagger
  * /password/token-login: