chore: link inline TODO/FIXME to tracking issues

src/main/java/com/fivucsas/identity/application/service/OAuth2Service.java

@@ -93,7 +93,7 @@ public class OAuth2Service {
     // format is still tolerated on read for in-flight codes written before deploy,
     // then re-serialized on next write. Remove the pipe fallback after the auth
     // code TTL (10 min) has elapsed post-deploy — earliest cleanup 2026-04-19 +15m.
-    // TODO(2026-04-19 +15m / 2026-04-19 03:15Z): delete legacy pipe parser below.
+    // TODO(#271)(2026-04-19 +15m / 2026-04-19 03:15Z): delete legacy pipe parser below.
     private static final ObjectMapper AUTH_CODE_MAPPER = new ObjectMapper();
 
     /**

src/main/java/com/fivucsas/identity/application/service/VerifyBiometricService.java

@@ -47,7 +47,7 @@ public BiometricResponse execute(VerifyBiometricCommand command) {
         UUID targetUserId = userId;
         String targetTenantId = command.getTenantId();
 
-        // TODO(flag-consistency): the verify gate keys off the denormalized
+        // TODO(#272)(flag-consistency): the verify gate keys off the denormalized
         // users.is_biometric_enrolled boolean, which can drift out of sync with
         // the bio embedding store (the "enrolled-but-412" class this PR addresses
         // on the WRITE side + via the admin reconciler). The more robust long-term

src/main/java/com/fivucsas/identity/application/service/verification/handlers/AddressProofHandler.java

@@ -37,7 +37,7 @@
  *
  * <p>P1 fix: see hygiene wave 2026-05-07.
  *
- * <p>TODO: Integrate with OCR/address validation service for automated extraction.
+ * <p>TODO(#274): Integrate with OCR/address validation service for automated extraction.
  *          Add address matching against government databases. Wire actual media
  *          storage (S3/equivalent) so {@code document_stored=true} reflects
  *          reality. Remove this profile gate once a real implementation ships.

src/main/java/com/fivucsas/identity/application/service/verification/handlers/WatchlistCheckHandler.java

@@ -61,7 +61,7 @@ public VerificationStepResult execute(VerificationSession session, int stepNumbe
             return VerificationStepResult.failure("Name is required for watchlist check");
         }
 
-        // TODO: Replace with real sanctions API call
+        // TODO(#273): Replace with real sanctions API call
         log.info("Watchlist check (mock) for session {}: name={}, nationality={}, dob={}",
                 session.getId(), name, nationality, dateOfBirth);