refactor: strip WP-/RB- ticket refs from backend (RD-19)

The backend half of the sweep RD-18 did for the front end. git blame
holds the provenance and stays correct when the code moves; the
comment names a closed ticket and tells the reader nothing the
sentence around it does not.

public/letter.css and LetterHtml.golden.html change together, because
the renderer inlines the CSS and the golden file snapshots the
result.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/openzaak/verify-notificatie.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
-# WP-58 — proves the "real write -> real webhook delivery" round-trip end-to-end: PATCHes the
+# Proves the "real write -> real webhook delivery" round-trip end-to-end: PATCHes the
 # zaak bootstrap-catalogus.sh seeded (a notified ZRC resource), then polls the BFF's own audit
-# trail (WP-41) for the resulting `zgw:notificatie` row. Requires bootstrap-catalogus.sh and
+# trail for the resulting `zgw:notificatie` row. Requires bootstrap-catalogus.sh and
 # bootstrap-notificaties.sh to have already run.
 set -euo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")"
@@ -29,7 +29,7 @@ jwt() {
   printf '%s.%s' "$signing_input" "$sig"
 }
 
-echo "Triggering a real write: PATCH $ZAAK_URL (bijwerken — WP-57 granted zaken.aanmaken"
+echo "Triggering a real write: PATCH $ZAAK_URL (bijwerken — the client is granted zaken.aanmaken"
 echo "for exactly ONE status, so a second status create 403s; a zaak update is the write this"
 echo "client's narrowed scope can repeat)..."
 response=$(curl -sS -X PATCH -H "Authorization: Bearer $(jwt)" -H 'Content-Type: application/json' \