docs(comments): strip internal task/milestone/bundle bookkeeping from code comments

Remove project bookkeeping citations from shipped code comments across the
solution: hyphenated task IDs (WP-14, StoreAndForward-025), milestone/task/
issue refs (M3, Task 4, Audit Log #23, #21), Bundle X task-bundle labels,
and C/D/K/S/T phase labels.

Comment text only — no code logic, string/log literals, or XML-doc structure
changed. Genuine descriptions are preserved (only the citation is stripped),
and technical lookalikes are retained (UTF-8, SHA-256, T00:00:00, M365,
UTC-5, pre-C4/pre-C5 schema versions). Flagged by the new CommentChecker
TaskReferenceInComment / TrackingReferenceInComment checks plus targeted
grep passes; full solution builds clean, append-only guard tests pass.

src/ZB.MOM.WW.ScadaBridge.CentralUI/Auth/AuthEndpoints.cs

@@ -45,7 +45,7 @@ public static class AuthEndpoints
             }
 
             // Map LDAP groups to roles via the shared IGroupRoleMapper<string> seam
-            // (Task 1.1 ScadaBridgeGroupRoleMapper, wrapping the DB-backed RoleMapper).
+            // (ScadaBridgeGroupRoleMapper, wrapping the DB-backed RoleMapper).
             // The full RoleMappingResult — including PermittedSiteIds and the
             // system-wide flag — is carried in the mapping's opaque Scope so the
             // site-scope→SiteId claims below are built exactly as before.
@@ -63,7 +63,7 @@ public static class AuthEndpoints
                 : new RoleMappingResult(roleMapping.Roles, [], IsSystemWideDeployment: false);
 
             // Build claims from LDAP auth + role mapping.
-            // CentralUI-005: no fixed "expires_at" absolute-cap claim is stamped
+            // No fixed "expires_at" absolute-cap claim is stamped
             // — session expiry is owned by the cookie middleware's sliding window
             // (ZB.MOM.WW.ScadaBridge.Security AddCookie: ExpireTimeSpan = idle timeout,
             // SlidingExpiration = true). A frozen absolute claim would contradict
@@ -71,11 +71,11 @@ public static class AuthEndpoints
             var displayName = string.IsNullOrEmpty(authResult.DisplayName) ? username : authResult.DisplayName;
             var resolvedUsername = string.IsNullOrEmpty(authResult.Username) ? username : authResult.Username;
 
-            // M2.19 (#15): build the cookie principal through the shared
+            // Build the cookie principal through the shared
             // SessionClaimBuilder — the SINGLE source of truth that the mid-session
             // OnValidatePrincipal role-refresh path ALSO uses, so login and refresh can
             // never drift. It stamps the canonical identity/role/scope claims (with
-            // roleType/nameType pinned for IsInRole), PLUS the M2.19 additions: one
+            // roleType/nameType pinned for IsInRole), PLUS these additions: one
             // zb:group claim per raw LDAP group (the durable input the mid-session
             // RoleMapper re-run consumes) and a zb:lastrolerefresh anchor (login time,
             // UTC) that also seeds the LastActivity idle anchor. The refresh timestamp is
@@ -147,7 +147,7 @@ public static class AuthEndpoints
             });
         }).DisableAntiforgery();
 
-        // Logout is a state-changing authenticated action (CentralUI-017): it
+        // Logout is a state-changing authenticated action: it
         // keeps antiforgery validation enabled so it cannot be triggered
         // cross-site. The NavMenu sign-out form includes the antiforgery token
         // (rendered by the <AntiforgeryToken /> component). There is deliberately
@@ -159,9 +159,9 @@ public static class AuthEndpoints
             context.Response.Redirect("/login");
         });
 
-        // CentralUI-020: liveness probe for the client-side idle-logout check.
+        // Liveness probe for the client-side idle-logout check.
         // The Blazor circuit's CookieAuthenticationStateProvider serves a frozen
-        // constructor-time principal (CentralUI-004), so a circuit can never
+        // constructor-time principal, so a circuit can never
         // observe a server-side cookie expiry by polling the auth state.
         // SessionExpiry instead polls this endpoint via fetch(): being a normal
         // HTTP request, the cookie middleware re-validates (and slides) the
@@ -178,7 +178,7 @@ public static class AuthEndpoints
     /// <summary>
     /// Handler for <c>GET /auth/ping</c>. Returns <c>200</c> while the caller's
     /// cookie session is still valid and <c>401</c> once it has lapsed
-    /// server-side. See CentralUI-020.
+    /// server-side.
     /// </summary>
     /// <param name="context">The current HTTP context used to check authentication state and write the response.</param>
     /// <returns>A task that represents the asynchronous operation.</returns>
@@ -192,7 +192,7 @@ public static class AuthEndpoints
 
     /// <summary>
     /// Builds the <see cref="AuthenticationProperties"/> for the login sign-in.
-    /// CentralUI-005: deliberately does <b>not</b> set <see cref="AuthenticationProperties.ExpiresUtc"/>.
+    /// Deliberately does <b>not</b> set <see cref="AuthenticationProperties.ExpiresUtc"/>.
     /// Session expiry is owned by the cookie authentication middleware's sliding
     /// window (configured in <c>ZB.MOM.WW.ScadaBridge.Security</c>'s <c>AddCookie</c>:
     /// <c>ExpireTimeSpan</c> = the idle timeout, <c>SlidingExpiration = true</c>).