cleanup(legibility): convert TODOs to issue refs; justify naming violators

CLEANUP-2 (#413): convert two actionable TODOs to issue-referenced stubs
- +layout.server.ts:29 → TODO(#453) for dedicated admin stats endpoint
- ChronikRow.svelte: TODO(#454) for commentPreview; keep SECURITY line
  as standalone comment (XSS guard stays co-located with the risk)

CLEANUP-3 (#414): add one-line justification comments to both naming
violators — SecurityUtils and GlobalExceptionHandler are both justified
by framework convention; no rename needed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/routes/admin/+layout.server.ts

@@ -26,8 +26,7 @@ export async function load({ fetch, locals }) {
 	const api = createApiClient(fetch);
 	const canManageUsers = hasPerm(user, 'ADMIN_USER');
 
-	// TODO: replace with a dedicated /api/admin/stats endpoint that returns counts only,
-	// so the System page does not load full entity lists it does not render.
+	// TODO(#453): replace with dedicated /api/admin/stats endpoint returning counts only
 	const [usersResult, groupsResult, tagsResult] = await Promise.all([
 		api.GET('/api/users'),
 		api.GET('/api/groups'),