docs: complete XML doc coverage (returns, summaries, inheritdoc)

Resolve all 622 issues flagged by the enhanced CommentChecker: add missing
<returns> tags (incl. the standard phrasing on non-generic Task methods),
add missing <summary> tags, and replace misused/redundant <inheritdoc/> on
members that override or implement nothing with real documentation.
Documentation-only — no behavior change; solution builds clean.

src/ZB.MOM.WW.ScadaBridge.Security/AuthorizationPolicies.cs

@@ -121,6 +121,7 @@ public static class AuthorizationPolicies
     /// Registers the ScadaBridge authorization policies (Admin, Design, Deployment, OperationalAudit, AuditExport).
     /// </summary>
     /// <param name="services">The service collection to register into.</param>
+    /// <returns>The same <paramref name="services"/> instance, for call chaining.</returns>
     public static IServiceCollection AddScadaBridgeAuthorization(this IServiceCollection services)
     {
         services.AddAuthorization(options =>

src/ZB.MOM.WW.ScadaBridge.Security/JwtTokenService.cs

@@ -74,6 +74,7 @@ public class JwtTokenService
     /// <param name="roles">Role names to embed as <see cref="RoleClaimType"/> claims.</param>
     /// <param name="permittedSiteIds">Site identifiers the user may deploy to; null for system-wide access.</param>
     /// <param name="lastActivity">Idle-timeout anchor; defaults to now when null (fresh login).</param>
+    /// <returns>The signed JWT string, ready to embed in a cookie or bearer header.</returns>
     public string GenerateToken(
         string displayName,
         string username,

src/ZB.MOM.WW.ScadaBridge.Security/ScadaBridgeGroupRoleMapper.cs

@@ -28,7 +28,14 @@ public sealed class ScadaBridgeGroupRoleMapper : IGroupRoleMapper<string>
         _roleMapper = roleMapper ?? throw new ArgumentNullException(nameof(roleMapper));
     }
 
-    /// <inheritdoc />
+    /// <summary>
+    /// Maps a list of LDAP/AD group names to ScadaBridge roles using the wrapped
+    /// <see cref="RoleMapper"/> and returns the resulting role mapping with site-scope
+    /// information carried in the opaque <c>Scope</c> field.
+    /// </summary>
+    /// <param name="groups">The AD/LDAP group names to resolve into roles.</param>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>A task that resolves to the group-to-role mapping including permitted site identifiers.</returns>
     public async Task<GroupRoleMapping<string>> MapAsync(IReadOnlyList<string> groups, CancellationToken ct)
     {
         var result = await _roleMapper.MapGroupsToRolesAsync(groups, ct);

src/ZB.MOM.WW.ScadaBridge.Security/ServiceCollectionExtensions.cs

@@ -33,6 +33,7 @@ public static class ServiceCollectionExtensions
     /// <c>IConfiguration</c>) and component libraries must not accept <c>IConfiguration</c>.
     /// </remarks>
     /// <param name="services">The service collection to register into.</param>
+    /// <returns>The same <paramref name="services"/> instance for chaining.</returns>
     public static IServiceCollection AddSecurity(this IServiceCollection services)
     {
         // Task 1.2 cutover: ScadaBridge's bespoke LdapAuthService was replaced by the
@@ -146,6 +147,7 @@ public static class ServiceCollectionExtensions
     /// Registers security-related Akka actors (placeholder for future actor registrations).
     /// </summary>
     /// <param name="services">The service collection to register into.</param>
+    /// <returns>The same <paramref name="services"/> instance for chaining.</returns>
     public static IServiceCollection AddSecurityActors(this IServiceCollection services)
     {
         // Phase 0: placeholder for Akka actor registration