Cut non-essential prose from docs and comments, and require the same of every future change

README loses the competitor comparison, the personas and the repeated philosophy; the
five near-identical E2E command blocks become a table plus one command, and the file
map a clause per entry. AGENTS.md keeps every decision but drops the narrative around
them. todo.md's completed items collapse to their task line — git holds the rest.

Comments lose restatement, README duplication and history ("used to", "originally",
dated notes). AGENTS.md gains a Prose discipline section making this a standing pass on
every change rather than a one-off cleanup.

src/compose.test.ts now expects 6 documented E2E run commands, not 10, since the README
states the command once instead of per suite.

src/http/security-headers.ts

@@ -1,15 +1,11 @@
-// Response security headers: set once per request in app.ts so every response — page,
-// JSON, redirect, static, or error — carries them (writeHead merges with setHeader). A plugin route
-// may override any of them per-response via RouteResult.headers (e.g. relax the CSP to ship its own JS).
+// Set once per request in app.ts, so every response carries them (writeHead merges with setHeader).
+// A plugin route may override any per-response via RouteResult.headers.
 
-// Strict default CSP for the zero-JS, server-rendered core:
-//  - script-src 'self'  : the core ships no JS; a plugin may still serve its own /public/<id>/*.js for
-//                         opt-in progressive enhancement. No 'unsafe-inline' ⇒ an injected <script>
-//                         can't run (the main XSS sink).
-//  - style-src adds 'unsafe-inline' : a few partials carry inline style= attributes.
-//  - img-src adds data:             : favicon + inline data URIs.
-//  - no form-action     : the themed login form posts to Kratos' (often cross-origin) action URL.
-//  - frame-ancestors 'none' : clickjacking guard (the modern X-Frame-Options).
+// The non-obvious parts of the CSP:
+//  - script-src 'self' with no 'unsafe-inline' ⇒ an injected <script> can't run. A plugin may still
+//    serve its own /public/<id>/*.js for opt-in progressive enhancement.
+//  - style-src adds 'unsafe-inline': a few partials carry inline style= attributes.
+//  - no form-action: the themed login form posts to Kratos' (often cross-origin) action URL.
 const CSP = [
   "base-uri 'self'",
   "default-src 'self'",