docs(xmldoc): fill missing XML docs + strip tracking-ID comments across src

Adds <summary>/<param>/<returns>/<inheritdoc> where missing and removes
project bookkeeping IDs (task/tracking refs) from shipped code comments,
so the docs read cleanly and CommentChecker is quiet except for known
false positives (PLC/protocol terms, event/IEqualityComparer inheritdoc).
Doc/comment-only; no logic changed; solution builds clean.

src/Server/ZB.MOM.WW.OtOpcUa.Security/Endpoints/AuthEndpoints.cs

@@ -132,7 +132,7 @@ public static class AuthEndpoints
         await http.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, principal);
 
         if (!isForm) return Results.NoContent();
-        // Security-001: validate returnUrl is a relative (local) URL before redirecting.
+        // Validate returnUrl is a relative (local) URL before redirecting.
         // An attacker can supply an absolute URL (e.g. https://evil.com) via a crafted link;
         // LoginCard echoes the value verbatim into the hidden form field. Fall back to the
         // app root rather than following the external URL (open-redirect prevention).