refactor: strip WP-/RB- ticket refs from backend (RD-19)

The backend half of the sweep RD-18 did for the front end. git blame
holds the provenance and stays correct when the code moves; the
comment names a closed ticket and tells the reader nothing the
sentence around it does not.

public/letter.css and LetterHtml.golden.html change together, because
the renderer inlines the CSS and the golden file snapshots the
result.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/tests/BigRegister.Tests/SwaggerGateTests.cs

@@ -6,7 +6,7 @@ using Microsoft.Extensions.DependencyInjection;
 
 namespace BigRegister.Tests;
 
-/// RB-15/BIO-015: `app.UseSwagger()`/`app.UseSwaggerUI()` used to run unconditionally — the
+/// BIO-015: `app.UseSwagger()`/`app.UseSwaggerUI()` used to run unconditionally — the
 /// OpenAPI document (every route + request/response shape) and SwaggerUI's "Try it out" were
 /// reachable in every environment, including a real deployment. Both are now gated behind
 /// `app.Environment.IsDevelopment()`.
@@ -16,26 +16,26 @@ public class SwaggerGateTests(TestWebApplicationFactory factory) : IClassFixture
   public async Task Swagger_document_is_served_in_development()
   {
     // The default test environment (WebApplicationFactory<T> defaults to "Development" when
-    // nothing overrides it — same fact RB-09's implementation note relies on) — this is the
+    // nothing overrides it — same fact a related implementation note relies on) — this is the
     // regression guard that the gate didn't also break the documented `npm run gen:api` /
     // local-dev-Swagger-UI experience.
     var res = await factory.CreateClient().GetAsync("/swagger/v1/swagger.json");
     Assert.Equal(HttpStatusCode.OK, res.StatusCode);
   }
 
-  /// Production cannot boot at all today (RB-09: no real IIdentityProvider exists yet), which
+  /// Production cannot boot at all today (no real IIdentityProvider exists yet), which
   /// is a *stronger* guarantee than "no Swagger in Production" — but it also means a plain
   /// `UseEnvironment("Production")` host never reaches this middleware to prove the gate
   /// itself works, only that the whole app refuses to start. This uses a third environment
   /// name (neither "Development" nor "Production") with a test-supplied `IIdentityProvider` —
   /// the one thing Program.cs doesn't register outside those two branches — so the host
-  /// actually boots and this test exercises the real gate, not RB-09's unrelated startup throw.
+  /// actually boots and this test exercises the real gate, not that unrelated startup throw.
   [Fact]
   public async Task Swagger_document_is_not_served_outside_development()
   {
     // Built on top of the shared `factory` fixture (via WithWebHostBuilder), not a bare `new
     // WebApplicationFactory<Program>()` — that keeps this host on the fixture's own per-class
-    // isolated AppDb temp path (see TestWebApplicationFactory's doc comment; RB-12's
+    // isolated AppDb temp path (see TestWebApplicationFactory's doc comment; an earlier
     // implementation note records the "table already exists" collision a bare factory hits
     // by sharing the mutable static Db.ConnectionString instead).
     using var staging = factory.WithWebHostBuilder(builder => builder