docs: complete XML doc comments via fixdocs (2757 to 131 findings)

Add missing <returns>/<param>/<summary>/<typeparam> tags and clean up
misused inheritdoc across 481 files so the documented API surface is
complete. Documentation-only (zero code lines changed). The 131 remaining
findings are inheritdoc-style warnings deliberately left to preserve
hand-written implementation rationale (plan-decision notes, race-condition
explanations).

tests/Server/ZB.MOM.WW.OtOpcUa.Security.Tests/CanonicalAdminRolesTests.cs

@@ -27,6 +27,9 @@ public sealed class CanonicalAdminRolesTests
 {
     // --- (a) the mapper mints the CANONICAL role claim for each native group ----------------
 
+    /// <summary>Verifies that the mapper yields the canonical role claim for each native LDAP group.</summary>
+    /// <param name="canonicalRole">The canonical role name to test.</param>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Theory]
     [InlineData("Viewer")]        // was ConfigViewer
     [InlineData("Designer")]      // was ConfigEditor
@@ -42,6 +45,10 @@ public sealed class CanonicalAdminRolesTests
         result.Roles.ShouldContain(canonicalRole);
     }
 
+    /// <summary>Verifies that a system-wide DB row role renders as the canonical role string.</summary>
+    /// <param name="role">The admin role enum value to test.</param>
+    /// <param name="expected">The expected canonical role string.</param>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Theory]
     [InlineData(AdminRole.Viewer, "Viewer")]
     [InlineData(AdminRole.Designer, "Designer")]
@@ -61,6 +68,8 @@ public sealed class CanonicalAdminRolesTests
 
     // --- (b)/(c) the REAL registered authorization policies enforce on the canonical values ---
 
+    /// <summary>Verifies that the Deployments role check authorizes Designer and Administrator roles.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task Deployments_role_check_authorizes_Designer_and_Administrator()
     {
@@ -76,6 +85,8 @@ public sealed class CanonicalAdminRolesTests
         (await authz.AuthorizeAsync(UserInRole("Viewer"), policy)).Succeeded.ShouldBeFalse();
     }
 
+    /// <summary>Verifies that the FleetAdmin policy authorizes only the Administrator role.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task FleetAdmin_policy_authorizes_only_Administrator()
     {
@@ -88,6 +99,8 @@ public sealed class CanonicalAdminRolesTests
         (await authz.AuthorizeAsync(UserInRole("Viewer"), "FleetAdmin")).Succeeded.ShouldBeFalse();
     }
 
+    /// <summary>Verifies that the DriverOperator policy authorizes Operator and Administrator roles.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task DriverOperator_policy_authorizes_Operator_and_Administrator()
     {
@@ -139,16 +152,31 @@ public sealed class CanonicalAdminRolesTests
 
     private sealed class FakeMappingService(IReadOnlyList<LdapGroupRoleMapping> rows) : ILdapGroupRoleMappingService
     {
+        /// <summary>Returns all seeded rows that belong to any of the specified LDAP groups.</summary>
+        /// <param name="ldapGroups">The LDAP groups to look up.</param>
+        /// <param name="cancellationToken">The cancellation token.</param>
+        /// <returns>A task that resolves to the matching role mappings.</returns>
         public Task<IReadOnlyList<LdapGroupRoleMapping>> GetByGroupsAsync(
             IEnumerable<string> ldapGroups, CancellationToken cancellationToken)
             => Task.FromResult(rows);
 
+        /// <summary>Returns all seeded role mapping rows.</summary>
+        /// <param name="cancellationToken">The cancellation token.</param>
+        /// <returns>A task that resolves to all role mappings.</returns>
         public Task<IReadOnlyList<LdapGroupRoleMapping>> ListAllAsync(CancellationToken cancellationToken)
             => Task.FromResult(rows);
 
+        /// <summary>Not supported in this stub.</summary>
+        /// <param name="row">The row to create.</param>
+        /// <param name="cancellationToken">The cancellation token.</param>
+        /// <returns>Never returns; always throws.</returns>
         public Task<LdapGroupRoleMapping> CreateAsync(LdapGroupRoleMapping row, CancellationToken cancellationToken)
             => throw new NotSupportedException();
 
+        /// <summary>Not supported in this stub.</summary>
+        /// <param name="id">The identifier of the row to delete.</param>
+        /// <param name="cancellationToken">The cancellation token.</param>
+        /// <returns>Never returns; always throws.</returns>
         public Task DeleteAsync(Guid id, CancellationToken cancellationToken)
             => throw new NotSupportedException();
     }