docs: complete XML doc comments via fixdocs (2757 to 131 findings)

Add missing <returns>/<param>/<summary>/<typeparam> tags and clean up
misused inheritdoc across 481 files so the documented API surface is
complete. Documentation-only (zero code lines changed). The 131 remaining
findings are inheritdoc-style warnings deliberately left to preserve
hand-written implementation rationale (plan-decision notes, race-condition
explanations).

tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests/LdapOpcUaUserAuthenticatorTests.cs

@@ -19,6 +19,7 @@ public sealed class LdapOpcUaUserAuthenticatorTests
 {
     /// <summary>On success the data-plane authenticator resolves roles via the mapper from the
     /// returned Groups — not from the auth result's Roles field — and grants identity.</summary>
+    /// <returns>A task that represents the asynchronous test operation.</returns>
     [Fact]
     public async Task Authenticate_LDAP_success_resolves_roles_via_mapper_from_groups()
     {
@@ -37,6 +38,7 @@ public sealed class LdapOpcUaUserAuthenticatorTests
 
     /// <summary>The DevStub pre-resolved roles (Administrator) survive the move to the mapper: they are
     /// unioned with the mapper output so the dev grant still reaches the OPC UA session.</summary>
+    /// <returns>A task that represents the asynchronous test operation.</returns>
     [Fact]
     public async Task Authenticate_devstub_preresolved_roles_are_unioned_with_mapper()
     {
@@ -54,6 +56,7 @@ public sealed class LdapOpcUaUserAuthenticatorTests
 
     /// <summary>A mapper fault (e.g. DB outage) must not deny an authenticated session — it falls
     /// back to the pre-resolved roles, matching the login endpoint's behaviour.</summary>
+    /// <returns>A task that represents the asynchronous test operation.</returns>
     [Fact]
     public async Task Authenticate_mapper_fault_falls_back_to_preresolved_roles()
     {
@@ -68,6 +71,7 @@ public sealed class LdapOpcUaUserAuthenticatorTests
     }
 
     /// <summary>Verifies that LDAP authentication failure returns Deny result with error text.</summary>
+    /// <returns>A task that represents the asynchronous test operation.</returns>
     [Fact]
     public async Task Authenticate_LDAP_failure_returns_Deny_with_error_text()
     {
@@ -82,6 +86,7 @@ public sealed class LdapOpcUaUserAuthenticatorTests
     }
 
     /// <summary>Verifies that LDAP exceptions are converted to backend error denial results.</summary>
+    /// <returns>A task that represents the asynchronous test operation.</returns>
     [Fact]
     public async Task Authenticate_LDAP_exception_returns_backend_error_denial()
     {
@@ -97,6 +102,7 @@ public sealed class LdapOpcUaUserAuthenticatorTests
     }
 
     /// <summary>Verifies that authentication falls back to username when LDAP omits display name.</summary>
+    /// <returns>A task that represents the asynchronous test operation.</returns>
     [Fact]
     public async Task Authenticate_falls_back_to_username_when_LDAP_omits_display_name()
     {
@@ -131,10 +137,7 @@ public sealed class LdapOpcUaUserAuthenticatorTests
         /// <param name="handler">The handler to invoke with the username to produce a result.</param>
         public FakeLdap(Func<string, LdapAuthResult> handler) => _handler = handler;
 
-        /// <summary>Authenticates a user asynchronously via the handler function.</summary>
-        /// <param name="username">The username to authenticate.</param>
-        /// <param name="password">The password (ignored by the fake).</param>
-        /// <param name="ct">Cancellation token for the operation.</param>
+        /// <inheritdoc />
         public Task<LdapAuthResult> AuthenticateAsync(string username, string password, CancellationToken ct = default)
             => Task.FromResult(_handler(username));
     }
@@ -145,6 +148,7 @@ public sealed class LdapOpcUaUserAuthenticatorTests
         /// <summary>Maps groups to roles via the configured delegate; Scope is always null.</summary>
         /// <param name="groups">The LDAP groups to map.</param>
         /// <param name="ct">The cancellation token.</param>
+        /// <returns>A task that resolves to the group role mapping result.</returns>
         public Task<GroupRoleMapping<string>> MapAsync(IReadOnlyList<string> groups, CancellationToken ct)
             => Task.FromResult(new GroupRoleMapping<string>(map(groups), Scope: null));
     }