docs(comments): strip internal task/milestone/bundle bookkeeping from code comments

Remove project bookkeeping citations from shipped code comments across the
solution: hyphenated task IDs (WP-14, StoreAndForward-025), milestone/task/
issue refs (M3, Task 4, Audit Log #23, #21), Bundle X task-bundle labels,
and C/D/K/S/T phase labels.

Comment text only — no code logic, string/log literals, or XML-doc structure
changed. Genuine descriptions are preserved (only the citation is stripped),
and technical lookalikes are retained (UTF-8, SHA-256, T00:00:00, M365,
UTC-5, pre-C4/pre-C5 schema versions). Flagged by the new CommentChecker
TaskReferenceInComment / TrackingReferenceInComment checks plus targeted
grep passes; full solution builds clean, append-only guard tests pass.

src/ZB.MOM.WW.ScadaBridge.ManagementService/AuditEndpoints.cs

@@ -17,8 +17,8 @@ using ZB.MOM.WW.ScadaBridge.Security;
 namespace ZB.MOM.WW.ScadaBridge.ManagementService;
 
 /// <summary>
-/// Minimal-API endpoints exposing the central Audit Log (#23) over HTTP for the
-/// ScadaBridge CLI (M8). Three routes:
+/// Minimal-API endpoints exposing the central Audit Log over HTTP for the
+/// ScadaBridge CLI. Three routes:
 /// <list type="bullet">
 ///   <item><c>GET /api/audit/query</c> — keyset-paged JSON page, gated on the
 ///   <see cref="AuthorizationPolicies.OperationalAudit"/> permission.</item>
@@ -154,13 +154,13 @@ public static class AuditEndpoints
             var last = canonical[^1];
             nextCursor = new
             {
-                // C3: canonical OccurredAtUtc is a DateTimeOffset; the cursor key is UTC.
+                // Canonical OccurredAtUtc is a DateTimeOffset; the cursor key is UTC.
                 afterOccurredAtUtc = last.OccurredAtUtc.UtcDateTime,
                 afterEventId = last.EventId,
             };
         }
 
-        // C3 (Task 2.5): decompose canonical rows into the flat AuditExportRow so the
+        // Decompose canonical rows into the flat AuditExportRow so the
         // CLI's JSON shape (24-field) is unchanged.
         var events = canonical.Select(AuditExportRow.From).ToList();
         var payload = new { events, nextCursor };
@@ -501,7 +501,7 @@ public static class AuditEndpoints
             }
 
             var last = page[^1];
-            // C3: canonical OccurredAtUtc is a DateTimeOffset; the keyset cursor column is UTC.
+            // Canonical OccurredAtUtc is a DateTimeOffset; the keyset cursor column is UTC.
             cursor = new AuditLogPaging(ExportPageSize, last.OccurredAtUtc.UtcDateTime, last.EventId);
         }
     }
@@ -534,7 +534,7 @@ public static class AuditEndpoints
 
     /// <summary>
     /// Applies the caller's <see cref="AuthenticatedUser.PermittedSiteIds"/> to the
-    /// audit-log filter (Management-019). System-wide callers (empty PermittedSiteIds —
+    /// audit-log filter. System-wide callers (empty PermittedSiteIds —
     /// Admin or a Deployment-style role with no scope rules attached to its mapping)
     /// see the filter unchanged. A scoped caller has any caller-supplied
     /// <c>sourceSiteId</c> intersected with their permitted set: an empty caller filter
@@ -552,7 +552,7 @@ public static class AuditEndpoints
     {
         // Empty PermittedSiteIds is the system-wide signal (Administrator,
         // system-wide Deployer). System-wide audit roles also fall here — the
-        // design treats Administrator/Viewer (the post-Task-1.7 audit roles) as
+        // design treats Administrator/Viewer (the audit roles) as
         // non-site-scoped unless an operator attaches scope rules to the LDAP
         // mapping; if they do, this helper enforces them.
         if (user.PermittedSiteIds.Length == 0)