test(guards): strip comments the way the compiler reads them, in every guard

Forty-two guard files carried their own comment stripper, block comments
first in one non-greedy pass, so a /* inside a line comment opened a
block that hid the code after it, and the stricter copies hid code
behind a /* inside a string, which every e2e route glob has. They all
read through the shared stripComments now, and it scans the way the
parser does: strings, template literals and regular expressions keep
every character, a comment inside a template expression goes, and line
numbers are kept. A parity test strips every source file both ways,
with the scanner and with the TypeScript parser, and fails on the first
that differs.

No guard reports anything new. Each one fails when the stripper returns
nothing; three of them passed on an empty file and assert that the code
they ban is read at all now.

src/app/api/__tests__/read-routes-write-nothing.test.ts

@@ -20,6 +20,7 @@ import { readFileSync } from "node:fs";
 import { join } from "node:path";
 
 import { describe, expect, it } from "vitest";
+import { stripComments } from "../../../__tests__/helpers/source-files";
 
 /** Mutating Prisma model methods, as they appear at a call site. */
 const PRISMA_WRITE =
@@ -48,7 +49,7 @@ function sourceOf(relative: string): string {
  * guard that fires on its own documentation.
  */
 function code(source: string): string {
-  return source.replace(/\/\*[\s\S]*?\*\//g, "").replace(/\/\/.*$/gm, "");
+  return stripComments(source);
 }
 
 describe("read routes issue no writes", () => {

src/app/api/auth/native/__tests__/invariants.test.ts

@@ -12,6 +12,7 @@ import { readFileSync } from "node:fs";
 import { join } from "node:path";
 
 import { guardSourceOf } from "@/__tests__/helpers/auth-guards";
+import { stripComments } from "../../../../../__tests__/helpers/source-files";
 
 const SRC = join(process.cwd(), "src");
 const read = (rel: string) => readFileSync(join(SRC, rel), "utf8");
@@ -22,9 +23,7 @@ const read = (rel: string) => readFileSync(join(SRC, rel), "utf8");
  * `redirect_uri` parameter").
  */
 function code(rel: string): string {
-  return read(rel)
-    .replace(/\/\*[\s\S]*?\*\//g, "")
-    .replace(/(^|[^:])\/\/.*$/gm, "$1");
+  return stripComments(read(rel), rel);
 }
 
 const ROUTE_FILES = [
@@ -43,6 +42,8 @@ describe("T6 — open redirect / redirect_uri removed by construction", () => {
     // Comments legitimately state "there is no redirect_uri parameter"; the
     // invariant is that no CODE reads or builds one.
     for (const rel of files) {
+      // A file read as nothing would pass the ban below.
+      expect(code(rel)).toMatch(/\bexport\b/);
       expect(code(rel)).not.toMatch(/redirect_uri/);
     }
   });
@@ -56,6 +57,7 @@ describe("T6 — open redirect / redirect_uri removed by construction", () => {
     // The routes build the Location only through the helper, never a bespoke
     // scheme string in code (doc comments naming the scheme are fine).
     for (const rel of ROUTE_FILES) {
+      expect(code(rel)).toMatch(/\bexport\b/);
       expect(code(rel)).not.toMatch(/"healthlog:\/\//);
     }
   });