docs(tests): fix CommentChecker findings across tests/ — 13,392 → 0 (repo-wide scan clean)

Comment/XML-doc changes only:
- add summaries to ~10k test methods, fixtures, fakes and helpers
  (+ <param> on theories, <returns> on async Task methods,
  <inheritdoc/> on interface implementations the checker can resolve)
- strip ~2.6k project-tracking references (WP*, P*-*, row-NN, Task N,
  #NN, Component-0NN) from comments, keeping the explanatory text;
  reword false positives in comments only
- real docs on fakes implementing BCL/library interfaces
  (IDisposable, ILogger, IOptionsMonitor, IAsyncLifetime)
- reword the last 5 src/ false positives (CWE-1236, failures-1,
  year-0001, M365)

Only non-comment edits: four one-line nested classes split across lines
so members can carry docs. Build 0 errors / 0 warnings.

tests/ZB.MOM.WW.ScadaBridge.ManagementService.Tests/ManagementAuthenticatorTests.cs

@@ -25,6 +25,7 @@ public class ManagementAuthenticatorTests
         return new DefaultHttpContext { RequestServices = services.BuildServiceProvider() };
     }
 
+    /// <summary>Verifies that no user is returned when the disable-login option is off.</summary>
     [Fact]
     public void TryDisableLoginUser_WhenDisabled_ReturnsNull()
     {
@@ -33,6 +34,7 @@ public class ManagementAuthenticatorTests
         Assert.Null(ManagementAuthenticator.TryDisableLoginUser(context));
     }
 
+    /// <summary>Verifies that no user is returned when no disable-login options are registered.</summary>
     [Fact]
     public void TryDisableLoginUser_WhenNoOptionsRegistered_ReturnsNull()
     {
@@ -44,6 +46,7 @@ public class ManagementAuthenticatorTests
         Assert.Null(ManagementAuthenticator.TryDisableLoginUser(context));
     }
 
+    /// <summary>Verifies that an enabled disable-login option returns a dev user holding all roles system-wide.</summary>
     [Fact]
     public void TryDisableLoginUser_WhenEnabled_ReturnsDevUserWithAllRolesSystemWide()
     {
@@ -58,6 +61,7 @@ public class ManagementAuthenticatorTests
         Assert.Empty(user.PermittedSiteIds); // empty == system-wide, mirrors AutoLoginAuthenticationHandler
     }
 
+    /// <summary>Verifies that an enabled option with a blank user falls back to the multi-role user.</summary>
     [Fact]
     public void TryDisableLoginUser_WhenEnabledWithBlankUser_FallsBackToMultiRole()
     {
@@ -69,6 +73,8 @@ public class ManagementAuthenticatorTests
         Assert.Equal("multi-role", user!.Username);
     }
 
+    /// <summary>Verifies that authentication bypasses Basic auth and returns the dev user when login is disabled.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task AuthenticateAsync_WhenDisabled_BypassesBasicAuthAndReturnsDevUser()
     {
@@ -84,6 +90,8 @@ public class ManagementAuthenticatorTests
         Assert.Equal(Roles.All, outcome.User.Roles);
     }
 
+    /// <summary>Verifies that authentication returns unauthorized when login is enabled and no header is sent.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task AuthenticateAsync_WhenEnabledWithNoHeader_ReturnsUnauthorized()
     {
@@ -139,6 +147,8 @@ public class ManagementAuthenticatorTests
         return (context.Response.StatusCode, body);
     }
 
+    /// <summary>Verifies that a locked-out key returns HTTP 429 without attempting an LDAP bind.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task AuthenticateAsync_LockedOutKey_Returns429WithoutLdapBind()
     {
@@ -156,6 +166,8 @@ public class ManagementAuthenticatorTests
         await ldap.DidNotReceiveWithAnyArgs().AuthenticateAsync(default!, default!, default);
     }
 
+    /// <summary>Verifies that a failed LDAP bind records a failure against the lockout tracker.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task AuthenticateAsync_FailedBind_RecordsFailure()
     {