refactor: rename org_uuid to dd_org_uuid, remove redundant comments

Rename config field to dd_org_uuid to match the DD_ORG_UUID env var.
Remove section header comments and inline comments that don't add value.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: jchrostek-dd

bottlecap/src/config/env.rs

@@ -483,7 +483,6 @@ pub struct EnvConfig {
     #[serde(deserialize_with = "deserialize_optional_duration_from_seconds")]
     pub api_security_sample_delay: Option<Duration>,
 
-    // Delegated Authentication
     /// @env `DD_ORG_UUID`
     ///
     /// The Datadog organization UUID. When set, delegated auth is auto-enabled.
@@ -692,8 +691,7 @@ fn merge_config(config: &mut Config, env_config: &EnvConfig) {
     merge_option_to_value!(config, env_config, api_security_enabled);
     merge_option_to_value!(config, env_config, api_security_sample_delay);
 
-    // Delegated Authentication
-    merge_string!(config, env_config, org_uuid);
+    merge_string!(config, dd_org_uuid, env_config, org_uuid);
 }
 
 #[derive(Debug, PartialEq, Clone, Copy)]
@@ -1055,8 +1053,7 @@ mod tests {
                 api_security_enabled: false,
                 api_security_sample_delay: Duration::from_secs(60),
 
-                // Delegated Authentication (not set in env, should be defaults)
-                org_uuid: String::default(),
+                dd_org_uuid: String::default(),
             };
 
             assert_eq!(config, expected_config);

bottlecap/src/config/mod.rs

@@ -364,8 +364,7 @@ pub struct Config {
     pub span_dedup_timeout: Option<Duration>,
     pub api_key_secret_reload_interval: Option<Duration>,
 
-    // Delegated Authentication
-    pub org_uuid: String,
+    pub dd_org_uuid: String,
 
     pub serverless_appsec_enabled: bool,
     pub appsec_rules: Option<String>,
@@ -482,8 +481,7 @@ impl Default for Config {
             span_dedup_timeout: None,
             api_key_secret_reload_interval: None,
 
-            // Delegated Authentication
-            org_uuid: String::default(),
+            dd_org_uuid: String::default(),
 
             serverless_appsec_enabled: false,
             appsec_rules: None,

bottlecap/src/config/yaml.rs

@@ -1037,8 +1037,7 @@ api_security_sample_delay: 60 # Seconds
                 dogstatsd_buffer_size: Some(65507),
                 dogstatsd_queue_size: Some(2048),
 
-                // Delegated Authentication (not set in yaml, should be defaults)
-                org_uuid: String::default(),
+                dd_org_uuid: String::default(),
             };
 
             // Assert that

bottlecap/src/delegated_auth/client.rs

@@ -62,7 +62,7 @@ pub async fn get_delegated_api_key(
         aws_credentials = get_snapstart_credentials(&aws_credentials).await?;
     }
 
-    let proof = generate_auth_proof(&aws_credentials, &aws_config.region, &config.org_uuid)?;
+    let proof = generate_auth_proof(&aws_credentials, &aws_config.region, &config.dd_org_uuid)?;
 
     let url = get_api_endpoint(&config.site);
     info!("Requesting delegated API key from: {}", url);

bottlecap/src/secrets/decrypt.rs

@@ -19,9 +19,7 @@ use tracing::{debug, error, info, warn};
 use crate::delegated_auth;
 
 pub async fn resolve_secrets(config: Arc<Config>, aws_config: Arc<AwsConfig>) -> Option<String> {
-    // Priority 1: Try delegated auth if DD_ORG_UUID is set
-    // Delegated auth is auto-enabled when org_uuid is present
-    if !config.org_uuid.is_empty() {
+    if !config.dd_org_uuid.is_empty() {
         match delegated_auth::get_delegated_api_key(&config, &aws_config).await {
             Ok(api_key) => {
                 info!("Delegated auth API key obtained successfully");
@@ -33,7 +31,6 @@ pub async fn resolve_secrets(config: Arc<Config>, aws_config: Arc<AwsConfig>) ->
         }
     }
 
-    // Priority 2-4: Try AWS secrets (Secrets Manager, KMS, SSM)
     let api_key_candidate = if !config.api_key_secret_arn.is_empty()
         || !config.kms_api_key.is_empty()
         || !config.api_key_ssm_arn.is_empty()

integration-tests/lib/stacks/auth.ts

@@ -38,7 +38,6 @@ export class AuthStack extends cdk.Stack {
       TS: Date.now().toString(),
     };
 
-    // Shared IAM role for all auth test functions
     const roleName = `${id}-role`;
     const role = new iam.Role(this, 'ExecutionRole', {
       roleName,
@@ -48,7 +47,6 @@ export class AuthStack extends cdk.Stack {
       ],
     });
 
-    // On-demand Node.js function
     const nodeFunctionName = `${id}-node`;
     const nodeFn = new lambda.Function(this, nodeFunctionName, {
       role,
@@ -67,7 +65,6 @@ export class AuthStack extends cdk.Stack {
     });
     nodeFn.addLayers(extensionLayer);
 
-    // SnapStart Java function
     const javaFunctionName = `${id}-java`;
     const javaFn = new lambda.Function(this, javaFunctionName, {
       role,