docs(xml): fill missing XML doc comments + strip task-tracking refs across src (fixdocs)

Add missing <summary>/<param>/<returns>/<typeparam> tags and switch
interface implementations to <inheritdoc/> across 106 files; strip
project bookkeeping identifiers (Task NN, #05-TNN, PLAN-04, StoreAndForward-0NN)
from shipped code comments while preserving the descriptive rationale.
Comment-only: zero code-logic lines changed; solution builds 0/0.

Claude-Session: https://claude.ai/code/session_01MtdgwpEeCUn6cUA5f1LMPj

src/ZB.MOM.WW.ScadaBridge.Security/Auth/AutoLoginAuthenticationHandler.cs

@@ -24,6 +24,11 @@ public sealed class AutoLoginAuthenticationHandler
     private readonly TimeProvider _clock;
 
     /// <summary>Initializes the handler with the scheme plumbing, the disable-login options, and the clock.</summary>
+    /// <param name="options">The authentication scheme options monitor.</param>
+    /// <param name="logger">The logger factory used by the base handler.</param>
+    /// <param name="encoder">The URL encoder used by the base handler.</param>
+    /// <param name="disableLoginOptions">The disable-login configuration, including the dev user to impersonate.</param>
+    /// <param name="clock">The time provider used to stamp the minted principal's refresh timestamp.</param>
     public AutoLoginAuthenticationHandler(
         IOptionsMonitor<AuthenticationSchemeOptions> options,
         ILoggerFactory logger,
@@ -37,9 +42,14 @@ public sealed class AutoLoginAuthenticationHandler
     }
 
     /// <summary>No-op: auto-login writes no cookie, so an explicit sign-in has nothing to persist.</summary>
+    /// <param name="user">The principal that would be signed in.</param>
+    /// <param name="properties">Authentication properties that would accompany the sign-in.</param>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     public Task SignInAsync(ClaimsPrincipal user, AuthenticationProperties? properties) => Task.CompletedTask;
 
     /// <summary>No-op: there is no auth cookie to clear; the next request re-authenticates via this handler.</summary>
+    /// <param name="properties">Authentication properties that would accompany the sign-out.</param>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     public Task SignOutAsync(AuthenticationProperties? properties) => Task.CompletedTask;
 
     /// <inheritdoc />

src/ZB.MOM.WW.ScadaBridge.Security/Auth/DisableLoginGuard.cs

@@ -10,6 +10,10 @@ namespace ZB.MOM.WW.ScadaBridge.Security.Auth;
 /// </summary>
 public static class DisableLoginGuard
 {
+    /// <summary>Throws if <paramref name="disableLogin"/> is set outside Development without the explicit override acknowledgement.</summary>
+    /// <param name="disableLogin">The configured <see cref="AuthDisableLoginOptions.DisableLogin"/> flag value.</param>
+    /// <param name="environmentName">The current hosting environment name (e.g. <c>Development</c>).</param>
+    /// <param name="allowOutsideDevelopment">The configured <see cref="AuthDisableLoginOptions.AllowOutsideDevelopment"/> second acknowledgement flag.</param>
     public static void Validate(bool disableLogin, string environmentName, bool allowOutsideDevelopment)
     {
         if (!disableLogin) return;

src/ZB.MOM.WW.ScadaBridge.Security/LoginThrottle.cs

@@ -67,6 +67,9 @@ public sealed class LoginThrottle
     /// currently locked out and a bind must be refused without contacting LDAP. Never mutates
     /// state (an expired lockout simply reads as unlocked; the entry is cleared on the next write).
     /// </summary>
+    /// <param name="username">The username being authenticated.</param>
+    /// <param name="ip">The client IP address of the bind attempt.</param>
+    /// <returns><c>true</c> when the key is currently locked out; otherwise <c>false</c>.</returns>
     public bool IsLockedOut(string username, string ip)
     {
         var opts = _options.Value;
@@ -82,6 +85,8 @@ public sealed class LoginThrottle
     /// Opens or advances the fixed window and, on reaching the configured threshold, arms the
     /// lockout. No-op when throttling is disabled.
     /// </summary>
+    /// <param name="username">The username that failed authentication.</param>
+    /// <param name="ip">The client IP address of the failed bind attempt.</param>
     public void RecordFailure(string username, string ip)
     {
         var opts = _options.Value;
@@ -120,6 +125,8 @@ public sealed class LoginThrottle
     /// Records a successful bind for the given <paramref name="username"/> +
     /// <paramref name="ip"/>, clearing any accumulated failure count and lockout for that key.
     /// </summary>
+    /// <param name="username">The username that authenticated successfully.</param>
+    /// <param name="ip">The client IP address of the successful bind attempt.</param>
     public void RecordSuccess(string username, string ip)
     {
         _entries.TryRemove(Key(username, ip), out _);

src/ZB.MOM.WW.ScadaBridge.Security/SecurityOptions.cs

@@ -137,7 +137,10 @@ public class SecurityOptions
 /// </remarks>
 public sealed class SecurityOptionsValidator : Microsoft.Extensions.Options.IValidateOptions<SecurityOptions>
 {
-    /// <inheritdoc/>
+    /// <summary>Validates the bound <see cref="SecurityOptions"/> at application startup, failing fast on invalid combinations.</summary>
+    /// <param name="name">The name of the options instance being validated, or <c>null</c> for the default instance.</param>
+    /// <param name="options">The <see cref="SecurityOptions"/> values to validate.</param>
+    /// <returns>A success result when the options are valid, otherwise a failure result describing the invalid setting.</returns>
     public Microsoft.Extensions.Options.ValidateOptionsResult Validate(string? name, SecurityOptions options)
     {
         // SECURITY: RoleRefreshThresholdMinutes must be strictly less than IdleTimeoutMinutes.