docs: keep block openers out of line comments in server sources

A '/*' inside a line comment opens a block for every guard that strips
block comments first, and the code after it disappears from that guard's
view. Four server comments and one new one did this; reword them.

src/app/api/medications/[id]/glp1/route.ts

@@ -64,7 +64,7 @@ export const GET = apiHandler(
     const { id } = await params;
 
     // v1.5.5 — close the §10 invariant 24 gap. The destructive
-    // sweep in af224964 lifted every sibling `[id]/**` handler onto the
+    // sweep in af224964 lifted every sibling `[id]` handler onto the
     // shared ownership helper; the glp1 GET still hand-rolled the
     // `findUnique + userId compare` pattern. Routing it through the
     // same predicate keeps the 404 leak shape identical across every

src/app/api/medications/[id]/intake/import/route.ts

@@ -105,7 +105,7 @@ export const POST = apiHandler(
 
     const { id } = await params;
     // v1.5.5 — route ownership through the shared helper so the
-    // 404 leak shape stays identical across every `[id]/**` handler.
+    // 404 leak shape stays identical across every `[id]` handler.
     const guard = await assertMedicationOwnership(id, user.id);
     if (guard) return guard;
 

src/lib/openapi/routes/cycle.ts

@@ -43,10 +43,10 @@ import {
 import { isoDateTime } from "@/lib/validations/datetime";
 
 // ── Cycle tracking (v1.15.0) ─────────────────────────────────────────
-// The `/api/cycle/*` capture / calendar / history / settings surface +
+// The `/api/cycle` capture / calendar / history / settings surface +
 // the cycle-prefs PATCH. Request bodies come from the Zod validation
 // module so the spec stays single-source; response DTOs are declared
-// here mirroring `src/lib/cycle/dto.ts`. Every `/api/cycle/*` route also
+// here mirroring `src/lib/cycle/dto.ts`. Every `/api/cycle` route also
 // 403s `{ errorCode:"cycle.disabled" }` when the feature gate is off.
 
 const predictionMethodEnumOpenapi = z

src/lib/openapi/routes/shared.ts

@@ -176,7 +176,7 @@ export function listEnvelope<T extends z.ZodType>(payload: T, id: string) {
 // annotated clone is exported from here under the name the use sites already
 // spell and the base import is aliased. A module that wants the published
 // form imports it from `./shared`; importing the raw schema from
-// `@/lib/validations/*` instead is what inlined these anonymously.
+// a `@/lib/validations` module instead is what inlined these anonymously.
 
 export const measurementTypeEnum = measurementTypeEnumBase.meta({
   id: "MeasurementType",

src/lib/sync/changes/pull.ts

@@ -112,7 +112,7 @@ export async function pullSyncChanges(input: {
   const { userId, token, limit, serverNow } = input;
 
   // Module gate: cycle. The `cycleDays` / `cycles` domains carry period
-  // days and per-day symptom rows, the same data every `/api/cycle/*` route
+  // days and per-day symptom rows, the same data every `/api/cycle` route
   // refuses with a 403 when the module is off. Without this the delta feed
   // re-served them ungated to the very same token.
   //