docs: complete XML doc coverage (returns, summaries, inheritdoc)

Resolve all 622 issues flagged by the enhanced CommentChecker: add missing
<returns> tags (incl. the standard phrasing on non-generic Task methods),
add missing <summary> tags, and replace misused/redundant <inheritdoc/> on
members that override or implement nothing with real documentation.
Documentation-only — no behavior change; solution builds clean.

src/ZB.MOM.WW.ScadaBridge.CentralUI/Auth/AuthEndpoints.cs

@@ -19,6 +19,7 @@ public static class AuthEndpoints
 {
     /// <summary>Registers the <c>/auth/login</c>, <c>/auth/logout</c>, and <c>/auth/ping</c> endpoints on the given route builder.</summary>
     /// <param name="endpoints">The route builder to add the endpoints to.</param>
+    /// <returns>The same <paramref name="endpoints"/> instance, for call chaining.</returns>
     public static IEndpointRouteBuilder MapAuthEndpoints(this IEndpointRouteBuilder endpoints)
     {
         endpoints.MapPost("/auth/login", async (HttpContext context) =>
@@ -198,6 +199,7 @@ public static class AuthEndpoints
     /// server-side. See CentralUI-020.
     /// </summary>
     /// <param name="context">The current HTTP context used to check authentication state and write the response.</param>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     public static Task HandlePing(HttpContext context)
     {
         context.Response.StatusCode = context.User.Identity?.IsAuthenticated == true
@@ -219,6 +221,7 @@ public static class AuthEndpoints
     /// <see cref="AuthenticationProperties.AllowRefresh"/> is left unset (null)
     /// so the middleware is free to slide the expiry on activity.
     /// </summary>
+    /// <returns>An <see cref="AuthenticationProperties"/> instance with <see cref="AuthenticationProperties.IsPersistent"/> set to <c>true</c> and no fixed expiry.</returns>
     public static AuthenticationProperties BuildSignInProperties() => new()
     {
         IsPersistent = true

src/ZB.MOM.WW.ScadaBridge.CentralUI/Auth/ClaimsPrincipalExtensions.cs

@@ -20,6 +20,7 @@ public static class ClaimsPrincipalExtensions
     /// <see cref="UnknownUser"/> when the claim is absent.
     /// </summary>
     /// <param name="principal">The claims principal to read the username from.</param>
+    /// <returns>The username claim value, or <see cref="UnknownUser"/> if absent.</returns>
     public static string GetUsername(this ClaimsPrincipal principal)
         => principal.FindFirst(JwtTokenService.UsernameClaimType)?.Value ?? UnknownUser;
 
@@ -28,6 +29,7 @@ public static class ClaimsPrincipalExtensions
     /// the claim is absent.
     /// </summary>
     /// <param name="principal">The claims principal to read the display name from.</param>
+    /// <returns>The display name claim value, or <c>null</c> if the claim is absent.</returns>
     public static string? GetDisplayName(this ClaimsPrincipal principal)
         => principal.FindFirst(JwtTokenService.DisplayNameClaimType)?.Value;
 
@@ -37,6 +39,7 @@ public static class ClaimsPrincipalExtensions
     /// ten components (CentralUI-024).
     /// </summary>
     /// <param name="authStateProvider">The Blazor authentication state provider to read from.</param>
+    /// <returns>A task that resolves to the current user's audit username, or <see cref="UnknownUser"/> if not authenticated.</returns>
     public static async Task<string> GetCurrentUsernameAsync(
         this AuthenticationStateProvider authStateProvider)
     {

src/ZB.MOM.WW.ScadaBridge.CentralUI/Auth/SiteScopeService.cs

@@ -38,6 +38,7 @@ public sealed class SiteScopeService
     /// True when the user is not restricted to a site subset (no <c>SiteId</c>
     /// claims). System-wide users see and act on every site.
     /// </summary>
+    /// <returns>A task that resolves to <c>true</c> if the user has no site-scope restriction.</returns>
     public async Task<bool> IsSystemWideAsync()
         => (await ResolveAsync()).IsSystemWide;
 
@@ -46,6 +47,7 @@ public sealed class SiteScopeService
     /// system-wide user (callers should consult <see cref="IsSystemWideAsync"/>
     /// or use the filter/allowed helpers, which already account for that).
     /// </summary>
+    /// <returns>A task that resolves to the set of permitted site IDs (empty for system-wide users).</returns>
     public async Task<IReadOnlySet<int>> PermittedSiteIdsAsync()
         => (await ResolveAsync()).Sites;
 
@@ -54,6 +56,7 @@ public sealed class SiteScopeService
     /// see. A system-wide user gets the full list back unchanged.
     /// </summary>
     /// <param name="sites">The full set of sites to filter.</param>
+    /// <returns>A task that resolves to the filtered list of sites the user is permitted to see.</returns>
     public async Task<List<Site>> FilterSitesAsync(IEnumerable<Site> sites)
     {
         var (isSystemWide, allowed) = await ResolveAsync();
@@ -67,6 +70,7 @@ public sealed class SiteScopeService
     /// Must be re-checked server-side before any mutating cross-site command.
     /// </summary>
     /// <param name="siteId">The <c>Site.Id</c> to check.</param>
+    /// <returns>A task that resolves to <c>true</c> when the user may operate on the given site.</returns>
     public async Task<bool> IsSiteAllowedAsync(int siteId)
     {
         var (isSystemWide, allowed) = await ResolveAsync();