docs(comments): strip internal task/milestone/bundle bookkeeping from code comments

Remove project bookkeeping citations from shipped code comments across the
solution: hyphenated task IDs (WP-14, StoreAndForward-025), milestone/task/
issue refs (M3, Task 4, Audit Log #23, #21), Bundle X task-bundle labels,
and C/D/K/S/T phase labels.

Comment text only — no code logic, string/log literals, or XML-doc structure
changed. Genuine descriptions are preserved (only the citation is stripped),
and technical lookalikes are retained (UTF-8, SHA-256, T00:00:00, M365,
UTC-5, pre-C4/pre-C5 schema versions). Flagged by the new CommentChecker
TaskReferenceInComment / TrackingReferenceInComment checks plus targeted
grep passes; full solution builds clean, append-only guard tests pass.

src/ZB.MOM.WW.ScadaBridge.Security/ServiceCollectionExtensions.cs

@@ -16,7 +16,7 @@ public static class ServiceCollectionExtensions
     /// <summary>
     /// The configuration section bound to the shared LDAP <c>LdapOptions</c>. Nested
     /// under the existing <c>ScadaBridge:Security</c> section as a <c>Ldap</c> sub-section
-    /// (Task 1.4 config rename) so the non-LDAP <see cref="SecurityOptions"/> fields stay
+    /// so the non-LDAP <see cref="SecurityOptions"/> fields stay
     /// where they are while the LDAP connection settings bind to the shared library.
     /// The Host composition root references this constant to register the shared LDAP
     /// auth (<c>AddZbLdapAuth</c>) before calling <see cref="AddSecurity"/>.
@@ -46,7 +46,7 @@ public static class ServiceCollectionExtensions
     /// <returns>The same <paramref name="services"/> instance for chaining.</returns>
     public static IServiceCollection AddSecurity(this IServiceCollection services, bool disableLogin = false)
     {
-        // Task 1.2 cutover: ScadaBridge's bespoke LdapAuthService was replaced by the
+        // ScadaBridge's bespoke LdapAuthService was replaced by the
         // shared ZB.MOM.WW.Auth.Ldap implementation (ScadaBridge was the donor for its
         // hardened bind-then-search / escaping / fail-closed semantics, so this was a
         // behaviour-equivalent re-point). That registration — AddZbLdapAuth, which binds
@@ -61,7 +61,7 @@ public static class ServiceCollectionExtensions
         services.AddScoped<JwtTokenService>();
         services.AddScoped<RoleMapper>();
 
-        // M2.19 (#15): the cookie OnValidatePrincipal core. Scoped to match the
+        // The cookie OnValidatePrincipal core. Scoped to match the
         // IGroupRoleMapper<string> it depends on (which depends on the Scoped
         // ISecurityRepository). The clock is injected (TimeProvider) so the idle/refresh
         // thresholds can be exercised deterministically in tests; the production default
@@ -81,7 +81,7 @@ public static class ServiceCollectionExtensions
         services.AddHttpContextAccessor();
         services.AddSingleton<IAuditActorAccessor, HttpAuditActorAccessor>();
 
-        // Auth-adoption Task 1.1: register the shared IGroupRoleMapper<string>
+        // Auth-adoption: register the shared IGroupRoleMapper<string>
         // seam additively, wrapping RoleMapper to reuse its DB-backed mapping +
         // site-scope union semantics. Scoped to match RoleMapper's lifetime (it
         // depends on the Scoped ISecurityRepository). The existing RoleMapper
@@ -89,7 +89,7 @@ public static class ServiceCollectionExtensions
         // to consume this seam in a later task.
         services.AddScoped<IGroupRoleMapper<string>, ScadaBridgeGroupRoleMapper>();
 
-        // M2.19 (#15): fail-fast config guard — RoleRefreshThresholdMinutes must be strictly
+        // Fail-fast config guard — RoleRefreshThresholdMinutes must be strictly
         // less than IdleTimeoutMinutes. If they are equal or inverted, a single un-refreshed
         // cycle can exhaust the entire idle window and idle enforcement is silently defeated.
         // SecurityOptionsValidator is registered with ValidateOnStart so a misconfigured
@@ -142,7 +142,7 @@ public static class ServiceCollectionExtensions
                 // SameSite / SecurePolicy / SlidingExpiration / ExpireTimeSpan are likewise
                 // applied there via ZbCookieDefaults.Apply.
 
-                // M2.19 (#15): OnValidatePrincipal enforces the idle timeout and refreshes
+                // OnValidatePrincipal enforces the idle timeout and refreshes
                 // the role/scope claims from the session's STORED LDAP groups (DB-backed
                 // RoleMapper, NO LDAP) so central role-mapping changes take effect
                 // mid-session. The lambda is a THIN adapter: it resolves the request-scoped
@@ -154,7 +154,7 @@ public static class ServiceCollectionExtensions
             });
         }
 
-        // CentralUI-005: configure the cookie session as a sliding window so the
+        // Configure the cookie session as a sliding window so the
         // code matches the documented policy ("sliding refresh, 30-minute idle
         // timeout"). ASP.NET cookie auth exposes a single ExpireTimeSpan plus a
         // SlidingExpiration flag — it cannot natively model a 15-minute sliding
@@ -169,7 +169,7 @@ public static class ServiceCollectionExtensions
         // session window. Bound here via PostConfigure so SecurityOptions
         // (configured by the Host after AddSecurity) is honoured.
         //
-        // Task 1.5: the cookie hardening (HttpOnly=true, SameSite=Strict,
+        // The cookie hardening (HttpOnly=true, SameSite=Strict,
         // SecurePolicy, SlidingExpiration=true, ExpireTimeSpan=idle) now comes from
         // the shared ZbCookieDefaults.Apply, with requireHttps + idleTimeout driven
         // by SecurityOptions so behaviour (30-min sliding idle window, HTTPS-only
@@ -193,7 +193,7 @@ public static class ServiceCollectionExtensions
                     ? SecurityOptions.DefaultCookieName
                     : cookieName;
 
-                // Security-021: when the operator opts out of HTTPS-only cookies,
+                // When the operator opts out of HTTPS-only cookies,
                 // log a Warning so an HTTP-only deployment is at least audible in
                 // the startup log. The cookie carries the embedded JWT bearer
                 // credential — over plain HTTP that travels in cleartext on every
@@ -213,7 +213,7 @@ public static class ServiceCollectionExtensions
     }
 
     /// <summary>
-    /// M2.19 (#15): the thin <see cref="CookieAuthenticationEvents.OnValidatePrincipal"/>
+    /// The thin <see cref="CookieAuthenticationEvents.OnValidatePrincipal"/>
     /// adapter. It resolves the request-scoped <see cref="CookieSessionValidator"/>,
     /// asks it for a decision, and applies it to the cookie context:
     /// <list type="bullet">