docs(webapp): correct the environment-scope comments on the environments route

Author: kathiekiwi

apps/webapp/app/routes/api.v1.projects.$projectRef.environments.ts

@@ -41,7 +41,7 @@ export const loader = createLoaderPATApiRoute(
       return json({ error: "Project not found" }, { status: 404 });
     }
 
-    // A delegated token signed for one environment only ever lists that one.
+    // An org claim makes the org the boundary; an environment claim alone lists that one only.
     const scope = await resolveUserActorEnvironmentScope(
       authentication.userActor,
       { projectId: project.id },

apps/webapp/app/services/userActorEnvironment.server.ts

@@ -145,6 +145,8 @@ export async function resolveUserActorEnvironmentScope(
     if (!project) {
       throw forbiddenEnvironment("This token isn't scoped to that organization.");
     }
+    // Nothing narrows, so `requestedEnvironmentSlugs` is the caller's own filter and isn't
+    // refused here. A route that opted in must not rely on this for environment filtering.
     return { scoped: false };
   }