chore: voice + filename hygiene + wave-4 state wrap

Maintainer-voice sweep across `src/`. ~190 references to the
maintainer by first name in code comments and JSDoc neutralised to
"the maintainer", "the live tenant", "users", or "the user" depending
on context. Three sed passes covering ~50 distinct patterns
(`Marc reported`, `Marc wants`, `Marc kept`, `Marc rolled back`, etc.).
Test fixtures (`displayName: "Marc B."`, `username: "marc"`,
`<HeroStrip userName="Marc">`) kept as opaque test data per the brief.

CHANGELOG normalisation. The v1.4.14 + v1.4.15 entries paired a
German bullet with its English translation by historical design — the
in-app copy is English-default and the user docs are English, so the
mixed-language style was a holdover from the early-marathon notes.
A one-off node script extracted the `_..._` English paragraph from
each bilingual bullet and rewrote the entry as that text. ~44 bullets
reduced; one Docs bullet that lost a leading word in the regex
fixed by hand.

CLAUDE.md → CONTRIBUTING-AI.md rename so the filename is no longer
AI-vendor-specific. `CONTRIBUTING.md` reference updated. `AGENTS.md`
stays in place for multi-agent compatibility (the conventions doc is
shared with Codex / Cursor / etc.).

Wave-4 state wrap. STATE.md now records C1–C5 + D + D2 as complete;
v1421-backlog.md grew a "Closed in v1.4.22" header listing the 20
items the marathon landed; `.planning/phase-W4-report.md` documents
the per-commit decisions, test deltas, and the 23 items deferred to
v1.4.23 with reasoning.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/app/api/ai/test/__tests__/route.test.ts

@@ -97,7 +97,7 @@ describe("POST /api/ai/test — provider error leak guard", () => {
     // v1.4.5: credential failures map to 422 (not 502) so Cloudflare
     // doesn't replace our JSON body with its HTML error page — that
     // rewrite was the root cause of the "Unexpected token '<'…" client
-    // crash Marc hit when typing a bad OpenAI key.
+    // crash the maintainer hit when typing a bad OpenAI key.
     expect(response.status).toBe(422);
     expect(body.error ?? "").not.toMatch(/sk-/);
     expect(body.error ?? "").not.toMatch(/api\.openai\.com/);
@@ -139,7 +139,7 @@ describe("POST /api/ai/test — provider error leak guard", () => {
 });
 
 // v1.4 fix: the dropdown in /settings was not honoured — the test always
-// ran against the SAVED provider (Marc reported "wirft was Komisches raus").
+// ran against the SAVED provider (the maintainer reported "wirft was Komisches raus").
 // The route now accepts a JSON override body and forwards the user's
 // unsaved selection to resolveProviderForTest().
 describe("POST /api/ai/test — dropdown-aware override", () => {

src/app/api/ai/test/route.ts

@@ -95,7 +95,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
     // rewritten by Cloudflare. 5xx from origin causes Cloudflare to swap
     // the body for its own HTML error page — `await res.json()` in the
     // browser then crashes with `Unexpected token '<', "<!DOCTYPE "`,
-    // which is exactly how Marc encountered this when typing a bad
+    // which is exactly how the maintainer encountered this when typing a bad
     // OpenAI key. 4xx codes pass through untouched.
     const status = err.httpStatus ?? 0;
     let outboundStatus: number;

src/app/api/dashboard/chart-overlay-prefs/route.ts

@@ -2,7 +2,7 @@
  * PUT /api/dashboard/chart-overlay-prefs — v1.4.18
  *
  * Persist a single chart's overlay-prefs (3 toggles) onto the existing
- * `User.dashboardWidgetsJson` blob. Marc rejected v1.4.16's always-on
+ * `User.dashboardWidgetsJson` blob. the maintainer rejected v1.4.16's always-on
  * chart overlays (gradient fill, personal-baseline reference line,
  * target-zone shading); the new pattern is per-chart switches that the
  * user opts into independently and that persist per user.

src/app/api/dashboard/widgets/route.ts

@@ -27,7 +27,7 @@ import type { NextRequest } from "next/server";
 // Dashboard UI (`src/components/settings/dashboard-layout-section.tsx`
 // iterates the full layout from `DEFAULT_DASHBOARD_LAYOUT`). Missing
 // one here makes the PUT 422 silently — the toast surfaces "Layout
-// konnte nicht gespeichert werden" — and Marc's tile-toggle looks
+// konnte nicht gespeichert werden" — and the user's tile-toggle looks
 // like it does nothing because the save round-trip never completes.
 // v1.4.16 A5 root-cause: `achievements` was absent from this enum so
 // every save attempted with the achievements widget present (i.e.

src/app/api/insights/generate/__tests__/route.test.ts

@@ -223,7 +223,7 @@ describe("POST /api/insights/generate — provider error mapping", () => {
 });
 
 // v1.4.16 A7.1: rate limit raised from 2 → 10/h, env-configurable.
-// Marc reported the previous 2/h was too aggressive when iterating on
+// the maintainer reported the previous 2/h was too aggressive when iterating on
 // settings. The 10/h ceiling is the new default; the env override lets
 // operators on a tight LLM budget dial it back without a rebuild.
 describe("POST /api/insights/generate — rate limit (v1.4.16 A7.1)", () => {

src/app/api/internal/deploy-webhook/route.ts

@@ -22,7 +22,7 @@ import { prisma } from "@/lib/db";
  * comes back asynchronously when the container is healthy / fails to
  * start. Without this surface we lose visibility once the deploy is
  * fired — exactly the gap that produced v1.4.6..v1.4.14's manual
- * verification recipe (Marc had to SSH and check digests).
+ * verification recipe (the maintainer had to SSH and check digests).
  *
  * Payload shape: Coolify sends a free-form JSON object whose exact
  * fields drift between beta releases. We treat it as `Record<string,
@@ -104,7 +104,7 @@ function hasValidSecret(request: NextRequest): boolean {
  * `src/lib/integrations/status.ts` — fan out a SYSTEM_ALERT through the
  * existing dispatcher to every user whose role is ADMIN. The dispatcher
  * silently no-ops when no Telegram channel is configured, so this is
- * safe even on a first-deploy where Marc hasn't wired the bot yet.
+ * safe even on a first-deploy where the maintainer hasn't wired the bot yet.
  */
 async function notifyAdminsOfFailure(event: NormalizedEvent): Promise<void> {
   const admins = await prisma.user.findMany({