fix: usable IPv6 spelling, and drop a SEP label that means something else here (round 2)

- The recovery text told users to move the endpoint to `::1`. A bare IPv6
  literal is not a legal URL host — `new URL("http://::1/token")` throws — so
  anyone copying that into the Token URL override got a parse error from advice
  meant to unblock them. Now `[::1]`, in both the notice and the manual
  reproduction guide.

  The exemption list still reads `::1`, because that is the host the SDK
  compares; only the remedy is bracketed, because that is what a user types.
  The comment says so, so neither gets "corrected" into the other.

- Dropped SEP-2207 from all nine files it had reached. I took the label from
  the SDK's own source comments, which attribute this check to it — but this
  repo already uses SEP-2207 for OIDC refresh / offline_access
  (specification/v2_auth_hardening.md, plus an e2e test), so grepping it here
  would have turned up two unrelated things. Replaced with plain description
  rather than a different SEP number: having guessed wrong once, guessing again
  is not the fix.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MvNbmAtQuWhDvzi4yXDju
Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/hooks/useConnectionLifecycle.ts

@@ -640,7 +640,7 @@ export function useConnectionLifecycle({
           });
           return;
         }
-        // SEP-2207 (#2280): a token endpoint the SDK will not post credentials
+        // A token endpoint the SDK will not post credentials
         // to. Terminal, so it gets a notice of its own rather than the generic
         // "Failed to connect" toast, whose detail line would be the raw SDK
         // text.
@@ -698,7 +698,7 @@ export function useConnectionLifecycle({
             // held. The fetch log survives a disconnect, so the Network
             // diagnostics this issue is about are unaffected.
             await client.disconnect().catch(() => {});
-            // SEP-2207 (#2280). The retried `connect()` above can raise the
+            // The terminal token-endpoint refusal (#2280). The retried `connect()` above can raise the
             // terminal refusal on its own — a satisfied challenge still ends in
             // a token exchange — and reporting that as a failed connect attempt
             // is doubly wrong here: the card goes red and the message is the
@@ -765,7 +765,7 @@ export function useConnectionLifecycle({
               });
               return;
             }
-            // See the SEP-2207 note on the handshake arm above (#2280). The
+            // See the note on the handshake arm above (#2280). The
             // disconnect already happened at the top of this catch.
             if (showInsecureTokenEndpointNotice(authErr, target.name)) {
               setReAuthBanner((prev) =>
@@ -1014,7 +1014,7 @@ export function useConnectionLifecycle({
             authorizationUrl: authUrl,
           });
         } catch (err) {
-          // SEP-2207 (#2280), and this is the path a user reaches by *acting*:
+          // The terminal token-endpoint refusal (#2280), on the path a user reaches by *acting*:
           // a connected session raises an ordinary re-auth banner, they click
           // Re-authenticate, and the token exchange is refused. Without this
           // the generic toast below reports it with the raw SDK text — the