EqualifyEverything / equalify-iris

First PR of the cleanup pass tracked at #460, and it turned out to be one class of defect rather than the two the issue named. What the issue asked for: the comment justifying the separate quality token argued against a per-user auth that #459 deleted, and the GitHub mock still faked a fork-and-PR flow Iris does not use. What the pass actually found. `auth` is attached PER ROUTE — index.ts hands it to `/v1/me` and `/v1/sessions` and to nothing else — so four endpoints (`/v1/health`, `/v1/stats`, `/v1/limits`, `/v1/quality`) answer on a gated deployment because they were never handed the middleware, not because of where their mount lines sit. A dozen comments, two docs pages, the demo page and config.example.yaml explained that by POSITION, one of them asserting the position was required. Position decides nothing here; the one middleware where order is load-bearing is the `/v1`-wide rate limit. Six rounds of review, five of them finding this PR making the error it was opened to remove, each time in the sentence the previous round's fix had just written: 1455adf the quality token's rationale, and the mock's fork-and-PR flow 643b59f position was never what kept the tally open (4 notes) 71d1ae8 seven sites carried the position claim, not the four reported 740433c the same words: a defect in config-test prose, true history in config.ts 231d039 "the first request the deployment serves" is false by this PR's own thesis 3e0a947 the last stale 401 sat two lines above the 500 it described Two findings needed the opposite of the obvious remedy. src/config.ts:747's `401 unauthorized: Token validation failed` is accurate history — past tense, the incident the normalizer was written for, verified at 92f9a2b^ — so it was annotated, not rewritten. store/db.ts:1027's operator-facing throw was left alone: its next step is delete-and-restart, so naming two mounts there buys no decision. Two sweeps are worth keeping. A line-based grep cannot see a wrapped comment (test/e2e.sh spells "has not signed / # in" across two `#` lines), which is why the first sweep missed three causal sites; a wrap-tolerant sweep found them. And a sweep of every comment naming an HTTP status against the call beside it found exactly one wrong, now fixed. Nothing executable changed. Gates on every commit: tsc clean, `npm test` 1694/1694, `./test/e2e.sh` exit 0 with 150 ✓ and 0 ✗. Refs #460