docs(src): fix CommentChecker findings across src/ — 1,032 → 5 (all false positives)

Comment/XML-doc changes only, no code logic:
- strip project-tracking references (WP*, P*-*, row-NN, #NN, Task N) from
  comments, keeping the explanatory rationale
- add missing summaries, <param>, <returns>, <typeparam> and <inheritdoc/>
- replace misused <inheritdoc/> with real docs; where <inheritdoc/> was
  combined with useful remarks, move the rationale into // comments
- drop stale replicationActor <param> on DeploymentManagerActor ctor

Remaining 5 are false positives (CWE-1236 x2, failures-1, year-0001, M365).
Build 0 errors / 0 warnings.

src/ZB.MOM.WW.ScadaBridge.Security/CookieSessionValidator.cs

@@ -86,6 +86,7 @@ public sealed class CookieSessionValidator
     /// <param name="options">Security options carrying the idle and role-refresh thresholds.</param>
     /// <param name="timeProvider">Clock source; injected so tests can advance time deterministically.</param>
     /// <param name="logger">Logger instance.</param>
+    /// <param name="activity">Optional tracker that records session activity for idle-timeout accounting.</param>
     public CookieSessionValidator(
         IGroupRoleMapper<string> roleMapper,
         IOptions<SecurityOptions> options,
@@ -106,6 +107,9 @@ public sealed class CookieSessionValidator
     /// </summary>
     /// <param name="principal">The current cookie principal under validation.</param>
     /// <param name="ct">Cancellation token (the request-aborted token in the pipeline).</param>
+    /// <param name="recordActivity">True to record this validation as session activity.</param>
+    /// <param name="forceRefresh">True to refresh role/scope claims regardless of the refresh interval.</param>
+    /// <param name="failClosed">True to propagate role-lookup errors instead of preserving current grants.</param>
     /// <returns>The action the caller must take and any replacement principal.</returns>
     public async Task<SessionValidationResult> ValidateAsync(ClaimsPrincipal? principal, CancellationToken ct = default, bool recordActivity = true, bool forceRefresh = false, bool failClosed = false)
     {

src/ZB.MOM.WW.ScadaBridge.Security/ServiceCollectionExtensions.cs

@@ -225,6 +225,8 @@ public static class ServiceCollectionExtensions
     }
 
     /// <summary>Requests that cannot by themselves establish user activity.</summary>
+    /// <param name="context">The HTTP context of the request.</param>
+    /// <returns><c>true</c> when the request is a passive session request.</returns>
     internal static bool IsPassiveSessionRequest(HttpContext context)
         => context.Request.Path.StartsWithSegments("/auth/ping")
             || context.Request.Path.StartsWithSegments("/auth/activity")

src/ZB.MOM.WW.ScadaBridge.Security/SessionActivityTracker.cs

@@ -16,6 +16,8 @@ public sealed class SessionActivityTracker
     private readonly Dictionary<string, DateTimeOffset> _activity = new(StringComparer.Ordinal);
 
     /// <summary>Returns the newer of the protected cookie anchor and this node's observed activity.</summary>
+    /// <param name="principal">The principal whose session activity is queried.</param>
+    /// <returns>The most recent activity time, or <see langword="null"/> when the principal carries no activity claim.</returns>
     public DateTimeOffset? LastActivity(ClaimsPrincipal principal)
     {
         if (!DateTimeOffset.TryParse(principal.FindFirst(JwtTokenService.LastActivityClaimType)?.Value, out var stamp))
@@ -26,6 +28,8 @@ public sealed class SessionActivityTracker
     }
 
     /// <summary>Records a validated interaction without changing another login's activity.</summary>
+    /// <param name="principal">The principal whose session is recorded.</param>
+    /// <param name="now">The time of the interaction.</param>
     public void Record(ClaimsPrincipal principal, DateTimeOffset now)
     {
         var id = principal.FindFirst(SessionIdClaim)?.Value;