docs(xmldoc): fill missing XML docs + strip tracking-ID comments across src

Adds <summary>/<param>/<returns>/<inheritdoc> where missing and removes
project bookkeeping IDs (task/tracking refs) from shipped code comments,
so the docs read cleanly and CommentChecker is quiet except for known
false positives (PLC/protocol terms, event/IEqualityComparer inheritdoc).
Doc/comment-only; no logic changed; solution builds clean.

src/Server/ZB.MOM.WW.OtOpcUa.Security/Ldap/OtOpcUaLdapAuthService.cs

@@ -29,7 +29,7 @@ namespace ZB.MOM.WW.OtOpcUa.Security.Ldap;
 /// <remarks>
 ///     Fail-closed: the library never throws, and this wrapper adds no new throwing paths. The
 ///     DevStub result grants the canonical <c>"Administrator"</c> control-plane role (group
-///     <c>"dev"</c>) so the dev session can navigate the full Admin UI (Task 1.7 renamed the prior
+///     <c>"dev"</c>) so the dev session can navigate the full Admin UI (renamed from the prior
 ///     <c>"FleetAdmin"</c> to the canonical <c>"Administrator"</c>).
 /// </remarks>
 public sealed class OtOpcUaLdapAuthService : ILdapAuthService
@@ -80,7 +80,7 @@ public sealed class OtOpcUaLdapAuthService : ILdapAuthService
         {
             // Dev bypass: accept any non-empty credentials and grant Administrator WITHOUT a real bind.
             // Pre-populated Roles are unioned with the mapper output by both consumers, so the grant
-            // survives the move to IGroupRoleMapper. (Task 1.7 canonicalized the role string from the
+            // survives the move to IGroupRoleMapper. (The role string was canonicalized from the
             // prior "FleetAdmin" to "Administrator".)
             _logger.LogWarning(
                 "OtOpcUaLdapAuthService: DevStubMode bypass — accepting {User} without a real LDAP bind", username);
@@ -90,7 +90,7 @@ public sealed class OtOpcUaLdapAuthService : ILdapAuthService
         // Fail closed on a plaintext transport unless explicitly opted in. The bespoke service
         // enforced this at login (not startup), so the host still boots with an insecure-by-default
         // config and only refuses the bind here — preserved verbatim after the UseTls→Transport
-        // migration (Task 1.4). The shared library's directory client does not re-check this.
+        // migration. The shared library's directory client does not re-check this.
         if (_options.Transport == LdapTransport.None && !_options.AllowInsecure)
             return new(false, null, username, [], [],
                 "Insecure LDAP is disabled. Enable a TLS transport or set AllowInsecure for dev/test.");