docs(session-affinity): trim test docstrings

Drop review-process meta and historical framing from the auth-context and
deny-path test docstrings; keep the present-tense description of what each test
verifies.

Signed-off-by: Pratik Gandhi <gandhipratik203@gmail.com>

Author: gandhipratik203

tests/unit/mcpgateway/middleware/test_csrf_middleware.py

@@ -234,10 +234,10 @@ async def test_exempt_path_passes_without_token():
 async def test_internal_mcp_dispatch_is_csrf_exempt_by_default():
     """``/_internal/mcp/*`` is CSRF-exempt by default (loopback-only, HMAC-gated).
 
-    Regression for the cross-worker forward 403: the affinity dispatch posts to
-    the trusted-internal endpoint, which must not require a CSRF token. Without
-    the exemption, custom AUTH_HEADER_NAME deployments (whose bearer the CSRF
-    short-circuit can't find) would 403 on the inner dispatch.
+    The affinity dispatch posts to the trusted-internal endpoint, which must not
+    require a CSRF token. Without the exemption, custom AUTH_HEADER_NAME
+    deployments (whose bearer the CSRF short-circuit can't find) would 403 on the
+    inner dispatch.
     """
     # First-Party
     from mcpgateway.config import settings as real_settings

tests/unit/mcpgateway/services/test_session_affinity.py

@@ -1523,10 +1523,8 @@ async def request(self, *, method, url, headers=None, content=None, timeout=None
     async def as_post_rpc(self, *, content=None, headers=None, timeout=None):
         """Adapter so this fake can stand in for ``utils.internal_http.post_rpc_in_process``.
 
-        After PR #4987 the executor dispatches via a single helper instead of
-        constructing its own ``httpx.AsyncClient``. Patching the helper to this
-        method lets the existing fake capture ``content``/``headers``/``timeout``
-        for the call-site assertions.
+        Patching the helper to this method lets the fake capture
+        ``content``/``headers``/``timeout`` for the call-site assertions.
         """
         self.last_post_kwargs = {"content": content, "headers": headers, "timeout": timeout}
         if self._raise_exc is not None:
@@ -2422,9 +2420,8 @@ async def test_execute_forwarded_http_request_preserves_custom_auth_header():
     """Executor side: the bearer is preserved under the CONFIGURED auth header.
 
     On a deployment with ``AUTH_HEADER_NAME=X-MCP-Gateway-Auth`` the CSRF bearer
-    short-circuit keys on that header (``get_auth_header_value``). Hardcoding
-    ``authorization`` would drop the bearer and risk a 403 on the inner dispatch.
-    Regression for the review finding on custom auth-header deployments.
+    short-circuit keys on that header, so hardcoding ``authorization`` would drop
+    the bearer and risk a 403 on the inner dispatch.
     """
     # Third-Party
     import orjson

tests/unit/mcpgateway/transports/test_streamablehttp_transport.py

@@ -8911,8 +8911,7 @@ async def test_local_affinity_post_preserves_custom_auth_header(monkeypatch):
     """Owner-direct dispatch preserves the bearer under the CONFIGURED auth header.
 
     On ``AUTH_HEADER_NAME=X-MCP-Gateway-Auth`` the bearer rides that header and
-    the CSRF short-circuit keys on it. Hardcoding ``authorization`` would drop it.
-    Regression for the review finding, owner-direct path.
+    the CSRF short-circuit keys on it, so hardcoding ``authorization`` would drop it.
     """
     # Third-Party
     import orjson

tests/unit/mcpgateway/utils/test_passthrough_headers.py

@@ -506,9 +506,7 @@ class TestLoopbackSkipTrustedInternalHeaders:
     server-established identity), ``x-contextforge-mcp-runtime``, and the HMAC.
     If the loopback passthrough echoed a client-supplied copy of those, a caller
     could spoof the trusted identity while the server's valid HMAC still rode
-    along (the trusted headers are set, then passthrough is ``update()``-d over
-    them). The loopback skip set must strip them. Regression for the review
-    finding on trusted-header overwrite.
+    along. The loopback skip set must strip them.
     """
 
     def test_filter_strips_trusted_internal_headers(self):