milestone 19: hygiene sweep - dead ecs surface, single-source constants, tls classification, frontend state hazards, docker smoke network fix

src/local/forward_client.zig

@@ -4,7 +4,7 @@
 //! resolver — which speaks port 53 and nothing else. `transport.Endpoint` knows
 //! only `https://` and `tls://` by design, so the configuration for this client
 //! comes from `validate.Resolver` instead. The interface it implements is the
-//! same `transport.Client` every upstream implements, so the Phase 7 handler
+//! same `transport.Client` every upstream implements, so `server/handler.zig`
 //! treats a forward zone exactly like any other exchange.
 //!
 //! No health tracking and no backoff live here. `upstream/health.zig` and