docs: correct roster access comment

src/server.ts

@@ -444,8 +444,7 @@ app.delete("/api/players/:playerId", async (req, res, next) => {
   } catch (error) { next(error); }
 });
 
-// Roster overview is shared for viewing; player writes and analysis choices
-// remain limited to the signed-in player's own roster.
+// Non-admin roster reads are scoped to the signed-in player's own roster.
 app.get("/api/players-overview", async (req, res, next) => {
   try {
     const current = await authenticatedUser(req, res);