Trim access-review connector comments

Cut verbose inline comments across the access-review connector changes:
the mechanical fact stays at the read site, while incident backstory
("millions of error logs in prod") and provider-specific rationale (why
Clerk reviews the wrong population) move to the commit history where they
belong. Also tighten a loose "a 4xx" to "an auth/not-found 4xx" so the
terminal-classification contract is not overstated. No behavior change.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/server/api/console/v1/resolver.go

@@ -366,11 +366,9 @@ func handleConnectorComplete(
 				}
 			}
 
-			// Vercel surfaces the customer's team as the `teamId` OAuth
-			// callback query parameter (camelCase, not in the token response
-			// body). When the install targets a personal account no teamId is
-			// sent — fall back to /v2/user.id as a synthetic TeamID; the v3
-			// members endpoint accepts personal-account UIDs.
+			// Personal-account installs send no teamId; fall back to
+			// /v2/user.id as a synthetic TeamID (the v3 members endpoint
+			// accepts personal-account UIDs).
 			if connectorProvider == coredata.ConnectorProviderVercel {
 				teamID := vercelCallbackTeamID(query)
 				if teamID == "" {
@@ -476,10 +474,9 @@ func handleConnectorOAuth2Error(
 	safeRedirect.Redirect(w, r, parsedURL.String(), "/", http.StatusSeeOther)
 }
 
-// vercelCallbackTeamID returns the team identifier Vercel surfaces on the
-// OAuth callback. Vercel uses the camelCase `teamId` query parameter (not the
-// snake_case `team_id` most other params use); the name is pinned by a test so
-// it cannot silently regress and leave every Vercel source without a team.
+// vercelCallbackTeamID returns the team identifier from Vercel's OAuth
+// callback. Vercel uses the camelCase `teamId` query param (not snake_case
+// `team_id`); the name is pinned by a test so it cannot silently regress.
 func vercelCallbackTeamID(query url.Values) string {
 	return query.Get("teamId")
 }