Remove completed todo.md + html-css-foundation mockups; strip dead §N phase refs from comments/docs (simplify visual E2E to drop the mockup-comparison oracle)

src/plugin-api.ts

@@ -1,4 +1,4 @@
-// The plugin author surface (todo §7) — the ONE module a plugin imports. It re-exports exactly the
+// The plugin author surface — the ONE module a plugin imports. It re-exports exactly the
 // stable contract: definePlugin + the manifest/handler types, the RequestContext, the auth guards,
 // and the request-body/CSRF/list-query helpers the blessed pattern needs. This barrel *is* the
 // contract boundary in code — the host may refactor any other src/* freely as long as it holds, so
@@ -16,7 +16,7 @@ export { CSRF_FIELD } from "./csrf.ts";
 // Sanitise an untrusted URL (upstream/user data) before rendering it in an href/src — partials
 // escape text but not URL schemes, so a `javascript:`/`data:` URL would be live XSS (see docs).
 export { safeUrl } from "./safe-url.ts";
-// Observability (§9): `ctx.log` (RequestContext) is the request logger; `tracedFetch` is a drop-in
+// Observability: `ctx.log` (RequestContext) is the request logger; `tracedFetch` is a drop-in
 // `fetch` a plugin uses for upstream calls so they join the request's trace (client span + traceparent).
 // The `Log` class is exported so a plugin can type/construct one (e.g. `new Log("none")` in a test).
 export { Log, tracedFetch } from "./logger.ts";