Removed random comments and replaced em-dashes with hyphens.

Backend/Main.py

@@ -80,9 +80,6 @@ Application.add_middleware(
 )
 
 
-# --- Auth ---------------------------------------------------------------
-
-
 class LoginRequest(BaseModel):
     Username: str
     Password: str
@@ -95,9 +92,6 @@ def AuthStatusEndpoint() -> dict:
 
 @Application.post("/api/auth/bootstrap")
 def BootstrapEndpoint(Body: LoginRequest) -> dict:
-    """Create the first (admin) account. Only usable while no users exist yet,
-    so there's no default/baked-in password sitting in the image.
-    """
     if AnyUsersExist():
         raise HTTPException(status_code=403, detail="Setup already completed.")
 
@@ -163,9 +157,6 @@ def PostUsersEndpoint(Body: CreateUserRequest, CurrentUser: dict = Depends(Requi
     return {"Created": True}
 
 
-# --- Profile (colour, avatar, username, password) --------------------------
-
-
 @Application.get("/api/profile/colours")
 def GetProfileColourOptionsEndpoint(CurrentUser: dict = Depends(GetCurrentUser)) -> list[str]:
     return UserColourOptions
@@ -238,10 +229,6 @@ def PutProfileUsernameEndpoint(
         RenameUserInBlame(OldUsername, NewUsername)
         RenameUserInGroups(OldUsername, NewUsername)
 
-        # Re-authenticate this same request under the new name so the
-        # person doesn't get logged out by their own rename. Any OTHER
-        # active session for the old name is left to fail naturally on its
-        # next request — a re-login there is the simplest correct outcome.
         OldToken = request.cookies.get(SessionCookieName)
         if OldToken:
             DeleteSession(OldToken)
@@ -275,13 +262,8 @@ def PutProfilePasswordEndpoint(
     return {"Changed": True}
 
 
-# --- Groups -----------------------------------------------------------------
-
-
 @Application.get("/api/groups")
 def GetGroupsEndpoint(CurrentUser: dict = Depends(GetCurrentUser)) -> list[dict]:
-    # Readable by anyone — picking an existing group as a lock target is
-    # open to everyone, same as picking a user.
     return ListGroups()
 
 
@@ -325,13 +307,6 @@ def PutGroupMembersEndpoint(
     return {"Saved": True}
 
 
-# --- Locked files/directories -----------------------------------------------
-# Setting a lock is open to anyone who currently has access to the path -
-# not admin-only. If you can see it, you're trusted to decide who else can.
-# Admins do NOT bypass locks (see Locks.IsPathAccessible) - Admin is a
-# management group, not a way to view everyone's private directories.
-
-
 @Application.get("/api/lock")
 def GetLockEndpoint(Root: str, Path: str, CurrentUser: dict = Depends(GetCurrentUser)) -> dict:
     RequirePathAccessible(Root, Path, CurrentUser)
@@ -366,14 +341,9 @@ def DeleteLockEndpoint(Root: str, Path: str, CurrentUser: dict = Depends(GetCurr
 
 @Application.get("/api/locks")
 def GetLocksEndpoint(CurrentUser: dict = Depends(RequireAdmin)) -> list[dict]:
-    # The full list (across every root/path) stays admin-only — it's a
-    # global overview, not a per-item action.
     return LoadLocks()
 
 
-# --- Files ----------------------------------------------------------------
-
-
 @Application.get("/api/roots")
 def GetRootsEndpoint(CurrentUser: dict = Depends(GetCurrentUser)) -> list[dict]:
     return ListRoots()
@@ -396,8 +366,6 @@ def GetTreeEndpoint(
     Username = CurrentUser["Username"]
     UserGroups = CurrentUser.get("Groups", [])
 
-    # A locked subdirectory (or anything inside one) shouldn't even appear
-    # in its parent's listing for someone without access to it.
     return [
         Entry
         for Entry in Entries
@@ -412,9 +380,6 @@ def GetTreeEndpoint(
 
 @Application.post("/api/note")
 def PostNoteEndpoint(Root: str, Path: str, CurrentUser: dict = Depends(GetCurrentUser)) -> dict:
-    """Find (or create, for a directory that predates this feature) the
-    directory's own note file, so it can be opened like any other file.
-    """
     RequirePathAccessible(Root, Path, CurrentUser)
 
     try:
@@ -625,11 +590,6 @@ def GetBlameEndpoint(Root: str, Path: str, CurrentUser: dict = Depends(GetCurren
 def GetRawFileEndpoint(
     RootName: str, FilePath: str, CurrentUser: dict = Depends(GetCurrentUser)
 ):
-    """Serves a file at a URL that mirrors its real directory structure
-    (unlike /api/file's query-param form), so relative links, stylesheets,
-    and scripts INSIDE a previewed HTML document resolve correctly against
-    sibling files in the same directory.
-    """
     RequirePathAccessible(RootName, FilePath, CurrentUser)
 
     try:
@@ -663,9 +623,6 @@ def GetBookEndpoint(Root: str, Path: str, CurrentUser: dict = Depends(GetCurrent
     return Book or {}
 
 
-# --- Settings / themes ------------------------------------------------------
-
-
 @Application.get("/api/settings")
 def GetSettingsEndpoint(CurrentUser: dict = Depends(GetCurrentUser)) -> dict:
     return LoadSettings(CurrentUser["Username"])
@@ -719,10 +676,6 @@ def DeleteThemeEndpoint(Name: str, CurrentUser: dict = Depends(GetCurrentUser))
     return {"Deleted": True}
 
 
-# In production, the frontend's built assets are copied alongside this file
-# under Frontend/dist (see Dockerfile) and served directly by the backend.
-# This stays unauthenticated — the SPA itself needs to load before it can
-# even show a login screen.
 FrontendDist = ApplicationDirectory.parent / "Frontend" / "dist"
 if FrontendDist.is_dir():
     Application.mount("/", StaticFiles(directory=str(FrontendDist), html=True), name="Frontend")