docs: add XML doc comments across src + Sister Projects section in CLAUDE.md

Bulk CommentChecker pass: fills in <param>/<inheritdoc> tags on public
APIs across all 23 src/ projects so the doc-coverage gate is green. Also
adds a Sister Projects section to CLAUDE.md pointing at the MxAccess
Gateway and OtOpcUa sibling repos, and gitignores local credential
captures (*login*.txt) and the wonder-app-vd03 deploy/ artifacts.

src/ScadaLink.CentralUI/ScriptAnalysis/SandboxInboundScriptHost.cs

@@ -14,15 +14,22 @@ namespace ScadaLink.CentralUI.ScriptAnalysis;
 /// </summary>
 public class SandboxInboundScriptHost
 {
+    /// <summary>Gets or initializes the script input parameters.</summary>
     public ScriptParameters Parameters { get; init; } = new();
 
+    /// <summary>Gets or initializes the cancellation token for the test run.</summary>
     public CancellationToken CancellationToken { get; init; }
 
+    /// <summary>Gets the route accessor; every call throws <see cref="ScriptSandboxException"/> in a test run.</summary>
     public RouteAccessor Route { get; } = new();
 
     /// <summary>Mirror of ScadaLink.InboundAPI.RouteHelper.</summary>
     public class RouteAccessor
     {
+        /// <summary>
+        /// Creates a sandbox route target that throws on every operation.
+        /// </summary>
+        /// <param name="instanceCode">The instance code (used only in the exception message).</param>
         public RouteTarget To(string instanceCode) => new(instanceCode);
     }
 
@@ -31,30 +38,61 @@ public class SandboxInboundScriptHost
     {
         private readonly string _instanceCode;
 
+        /// <summary>
+        /// Initializes the sandbox route target for the given instance code.
+        /// </summary>
+        /// <param name="instanceCode">The instance code referenced by the routing expression (used in the exception message).</param>
         internal RouteTarget(string instanceCode) => _instanceCode = instanceCode;
 
+        /// <summary>
+        /// Always throws <see cref="ScriptSandboxException"/>; cross-site routing is unavailable in a Test Run.
+        /// </summary>
+        /// <param name="scriptName">Script name (included in the exception message).</param>
+        /// <param name="parameters">Unused parameters.</param>
+        /// <param name="cancellationToken">Unused token.</param>
         public Task<object?> Call(
             string scriptName,
             object? parameters = null,
             CancellationToken cancellationToken = default) =>
             throw Unavailable($"Call(\"{scriptName}\")");
 
+        /// <summary>
+        /// Always throws <see cref="ScriptSandboxException"/>; cross-site routing is unavailable in a Test Run.
+        /// </summary>
+        /// <param name="attributeName">Attribute name (included in the exception message).</param>
+        /// <param name="cancellationToken">Unused token.</param>
         public Task<object?> GetAttribute(
             string attributeName,
             CancellationToken cancellationToken = default) =>
             throw Unavailable($"GetAttribute(\"{attributeName}\")");
 
+        /// <summary>
+        /// Always throws <see cref="ScriptSandboxException"/>; cross-site routing is unavailable in a Test Run.
+        /// </summary>
+        /// <param name="attributeNames">Attribute names (unused).</param>
+        /// <param name="cancellationToken">Unused token.</param>
         public Task<IReadOnlyDictionary<string, object?>> GetAttributes(
             IEnumerable<string> attributeNames,
             CancellationToken cancellationToken = default) =>
             throw Unavailable("GetAttributes(...)");
 
+        /// <summary>
+        /// Always throws <see cref="ScriptSandboxException"/>; cross-site routing is unavailable in a Test Run.
+        /// </summary>
+        /// <param name="attributeName">Attribute name (included in the exception message).</param>
+        /// <param name="value">Unused value.</param>
+        /// <param name="cancellationToken">Unused token.</param>
         public Task SetAttribute(
             string attributeName,
             string value,
             CancellationToken cancellationToken = default) =>
             throw Unavailable($"SetAttribute(\"{attributeName}\")");
 
+        /// <summary>
+        /// Always throws <see cref="ScriptSandboxException"/>; cross-site routing is unavailable in a Test Run.
+        /// </summary>
+        /// <param name="attributeValues">Unused attribute values.</param>
+        /// <param name="cancellationToken">Unused token.</param>
         public Task SetAttributes(
             IReadOnlyDictionary<string, string> attributeValues,
             CancellationToken cancellationToken = default) =>