docs(comments): strip internal task/milestone/bundle bookkeeping from code comments

Remove project bookkeeping citations from shipped code comments across the
solution: hyphenated task IDs (WP-14, StoreAndForward-025), milestone/task/
issue refs (M3, Task 4, Audit Log #23, #21), Bundle X task-bundle labels,
and C/D/K/S/T phase labels.

Comment text only — no code logic, string/log literals, or XML-doc structure
changed. Genuine descriptions are preserved (only the citation is stripped),
and technical lookalikes are retained (UTF-8, SHA-256, T00:00:00, M365,
UTC-5, pre-C4/pre-C5 schema versions). Flagged by the new CommentChecker
TaskReferenceInComment / TrackingReferenceInComment checks plus targeted
grep passes; full solution builds clean, append-only guard tests pass.

src/ZB.MOM.WW.ScadaBridge.InboundAPI/InboundApiOptions.cs

@@ -3,7 +3,7 @@ namespace ZB.MOM.WW.ScadaBridge.InboundAPI;
 public class InboundApiOptions
 {
     /// <summary>
-    /// Default cap on the inbound API request body, in bytes (InboundAPI-006).
+    /// Default cap on the inbound API request body, in bytes.
     /// </summary>
     public const long DefaultMaxRequestBodyBytes = 1L * 1024 * 1024; // 1 MiB
 
@@ -11,7 +11,7 @@ public class InboundApiOptions
     public TimeSpan DefaultMethodTimeout { get; set; } = TimeSpan.FromSeconds(30);
 
     /// <summary>
-    /// InboundAPI-006: maximum accepted request body size for <c>POST /api/{methodName}</c>.
+    /// Maximum accepted request body size for <c>POST /api/{methodName}</c>.
     /// Requests whose body exceeds this are rejected with HTTP 413 before being
     /// buffered into a <see cref="System.Text.Json.JsonDocument"/>. The inbound API
     /// has no rate limiting (a deliberate design choice), so an explicit, modest cap
@@ -23,7 +23,7 @@ public class InboundApiOptions
     /// Server-side HMAC pepper for inbound-API bearer credentials, bound from
     /// <c>ScadaBridge:InboundApi:ApiKeyPepper</c>.
     /// <para>
-    /// Auth re-arch (C5): the legacy SQL Server hashing path that consumed this
+    /// Auth re-arch: the legacy SQL Server hashing path that consumed this
     /// property was retired. The pepper itself is still required — the shared
     /// ZB.MOM.WW.Auth.ApiKeys verifier reads the SAME configuration key
     /// (<c>PepperSecretName</c> in the Host composition root points at it) to pepper