refactor: strip WP-/RB- ticket refs from backend (RD-19)

The backend half of the sweep RD-18 did for the front end. git blame
holds the provenance and stays correct when the code moves; the
comment names a closed ticket and tells the reader nothing the
sentence around it does not.

public/letter.css and LetterHtml.golden.html change together, because
the renderer inlines the CSS and the golden file snapshots the
result.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/tests/BigRegister.Tests/EndpointTests.cs

@@ -87,7 +87,7 @@ public class EndpointTests(TestWebApplicationFactory factory) : IClassFixture<Te
         new { telefoon = "nope" });
     Assert.Equal(HttpStatusCode.UnprocessableEntity, res.StatusCode);
     // The Submit helper's rejection shape — was asserted through POST /registrations until
-    // RB-06 deleted it; /change-requests is the other endpoint on the same helper.
+    // that endpoint was deleted; /change-requests is the other endpoint on the same helper.
     var contentType = res.Content.Headers.ContentType;
     Assert.NotNull(contentType);
     Assert.Contains("application/problem+json", contentType.ToString());
@@ -200,8 +200,8 @@ public class EndpointTests(TestWebApplicationFactory factory) : IClassFixture<Te
   public async Task User_delete_blocked_with_409_once_linked_to_submission()
   {
     var doc = await Upload(Guid.NewGuid().ToString());
-    // Through the real submit path (RB-06 deleted POST /registrations, which was the only
-    // other caller of DocumentStore.Link and had no ownership guard on it).
+    // Through the real submit path (POST /registrations was the only other caller of
+    // DocumentStore.Link and had no ownership guard on it; it has since been deleted).
     var created = await _client.PostAsJsonAsync("/api/v1/aanvragen", new { type = "registratie" });
     var aanvraag = (await created.Content.ReadFromJsonAsync<AanvraagDetailDto>())!;
     var submit = await _client.PostAsJsonAsync($"/api/v1/aanvragen/{aanvraag.Id}/submit",
@@ -213,7 +213,7 @@ public class EndpointTests(TestWebApplicationFactory factory) : IClassFixture<Te
   [Fact]
   public async Task Admin_delete_requires_admin_role()
   {
-    // RB-08: routed through CasesAdmin (cases:manage), like the other admin-cases
+    // Routed through CasesAdmin (cases:manage), like the other admin-cases
     // endpoints, not the standalone X-Admin header this used to accept.
     var doc = await Upload(Guid.NewGuid().ToString());
     Assert.Equal(HttpStatusCode.Forbidden, (await _client.DeleteAsync($"/api/v1/admin/uploads/{doc.DocumentId}")).StatusCode);