refactor: strip WP-/RB- ticket refs from backend (RD-19)

The backend half of the sweep RD-18 did for the front end. git blame
holds the provenance and stays correct when the code moves; the
comment names a closed ticket and tells the reader nothing the
sentence around it does not.

public/letter.css and LetterHtml.golden.html change together, because
the renderer inlines the CSS and the golden file snapshots the
result.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/tests/BigRegister.Tests/IdempotencyTests.cs

@@ -45,7 +45,7 @@ public class IdempotencyTests(TestWebApplicationFactory factory) : IClassFixture
     Assert.NotEqual(firstBody!.Referentie, secondBody!.Referentie);
   }
 
-  // RB-18/BIO-018: IdempotencyStore used to key on the raw client-supplied header alone, so
+  // BIO-018: IdempotencyStore used to key on the raw client-supplied header alone, so
   // caller B replaying caller A's Idempotency-Key got caller A's cached reference back —
   // a cross-caller leak of a value caller B never submitted. The store now keys on
   // "{SubjectId}:{idemKey}", so the same header value from two different callers is two