docs(tests): fix CommentChecker findings across tests/ — 13,392 → 0 (repo-wide scan clean)

Comment/XML-doc changes only:
- add summaries to ~10k test methods, fixtures, fakes and helpers
  (+ <param> on theories, <returns> on async Task methods,
  <inheritdoc/> on interface implementations the checker can resolve)
- strip ~2.6k project-tracking references (WP*, P*-*, row-NN, Task N,
  #NN, Component-0NN) from comments, keeping the explanatory text;
  reword false positives in comments only
- real docs on fakes implementing BCL/library interfaces
  (IDisposable, ILogger, IOptionsMonitor, IAsyncLifetime)
- reword the last 5 src/ false positives (CWE-1236, failures-1,
  year-0001, M365)

Only non-comment edits: four one-line nested classes split across lines
so members can carry docs. Build 0 errors / 0 warnings.

tests/ZB.MOM.WW.ScadaBridge.ManagementService.Tests/RoleMappingValidationTests.cs

@@ -12,7 +12,7 @@ using ZB.MOM.WW.ScadaBridge.Security;
 namespace ZB.MOM.WW.ScadaBridge.ManagementService.Tests;
 
 /// <summary>
-/// Security-023 (membership-validation half): the LDAP-group-mapping <c>Role</c> arrives
+/// Membership validation: the LDAP-group-mapping <c>Role</c> arrives
 /// as a free string over the CLI/Management API. The single server-side write path
 /// (<c>ManagementActor.HandleCreateRoleMapping</c> / <c>HandleUpdateRoleMapping</c>) now
 /// rejects any role that is not in the canonical <see cref="Roles.All"/> set, returning a
@@ -21,7 +21,7 @@ namespace ZB.MOM.WW.ScadaBridge.ManagementService.Tests;
 /// a silent-misconfiguration footgun rather than changing behaviour.
 /// </summary>
 /// <remarks>
-/// Per Security-023's scope: only the membership check is added. The pre-existing
+/// Scope: only the membership check is added. The pre-existing
 /// case-sensitivity asymmetry (case-sensitive UI <c>RequireClaim</c> vs case-insensitive
 /// ManagementActor authz) is a separately-deferred change and is NOT touched — the
 /// membership check accepts a correctly-cased canonical role and stores it verbatim.
@@ -32,6 +32,7 @@ public class RoleMappingValidationTests : TestKit, IDisposable
     private readonly IAuditService _auditService;
     private readonly ServiceCollection _services;
 
+    /// <summary>Initializes the test with mocked repositories and a configuration transaction.</summary>
     public RoleMappingValidationTests()
     {
         _securityRepo = Substitute.For<ISecurityRepository>();
@@ -55,8 +56,10 @@ public class RoleMappingValidationTests : TestKit, IDisposable
         new(new AuthenticatedUser("admin", "admin", new[] { Roles.Administrator }, Array.Empty<string>()),
             command, Guid.NewGuid().ToString("N"));
 
+    /// <inheritdoc />
     void IDisposable.Dispose() => Shutdown();
 
+    /// <summary>Verifies that creating a role mapping with an unknown role returns an error and inserts no row.</summary>
     [Fact]
     public void CreateRoleMapping_UnknownRole_ReturnsError_NoRowInserted()
     {
@@ -69,11 +72,12 @@ public class RoleMappingValidationTests : TestKit, IDisposable
         _securityRepo.DidNotReceiveWithAnyArgs().AddMappingAsync(default!, default);
     }
 
+    /// <summary>Verifies that creating a role mapping with a misspelled canonical role returns an error and inserts no row.</summary>
     [Fact]
     public void CreateRoleMapping_MisspelledCanonicalRole_ReturnsError_NoRowInserted()
     {
         // A pure typo of a real role ("Deploer" for "Deployer") is exactly the silent
-        // footgun Security-023 describes: it would stamp a role claim no policy matches.
+        // footgun this validation guards against: it would stamp a role claim no policy matches.
         var actor = CreateActor();
         actor.Tell(Envelope(new CreateRoleMappingCommand("SCADA-Deploy", "Deploer")));
 
@@ -82,6 +86,7 @@ public class RoleMappingValidationTests : TestKit, IDisposable
         _securityRepo.DidNotReceiveWithAnyArgs().AddMappingAsync(default!, default);
     }
 
+    /// <summary>Verifies that updating a role mapping to an unknown role returns an error and updates no row.</summary>
     [Fact]
     public void UpdateRoleMapping_UnknownRole_ReturnsError_NoRowUpdated()
     {
@@ -96,6 +101,7 @@ public class RoleMappingValidationTests : TestKit, IDisposable
         _securityRepo.DidNotReceiveWithAnyArgs().UpdateMappingAsync(default!, default);
     }
 
+    /// <summary>Verifies that creating a role mapping with a canonical role succeeds and inserts the row.</summary>
     [Fact]
     public void CreateRoleMapping_CanonicalRole_Succeeds_RowInserted()
     {
@@ -114,6 +120,7 @@ public class RoleMappingValidationTests : TestKit, IDisposable
         Assert.Equal("SCADA-Deploy", inserted.LdapGroupName);
     }
 
+    /// <summary>Verifies that creating a role mapping with a lowercase role stores the canonical casing.</summary>
     [Fact]
     public void CreateRoleMapping_LowercaseRole_StoresCanonicalCasing()
     {
@@ -135,6 +142,7 @@ public class RoleMappingValidationTests : TestKit, IDisposable
         Assert.Equal("Deployer", inserted!.Role); // canonical, not the verbatim "deployer"
     }
 
+    /// <summary>Verifies that updating a role mapping with a lowercase role stores the canonical casing.</summary>
     [Fact]
     public void UpdateRoleMapping_LowercaseRole_StoresCanonicalCasing()
     {