docs: complete XML doc comments via fixdocs (2757 to 131 findings)

Add missing <returns>/<param>/<summary>/<typeparam> tags and clean up
misused inheritdoc across 481 files so the documented API surface is
complete. Documentation-only (zero code lines changed). The 131 remaining
findings are inheritdoc-style warnings deliberately left to preserve
hand-written implementation rationale (plan-decision notes, race-condition
explanations).

tests/Server/ZB.MOM.WW.OtOpcUa.Security.Tests/OtOpcUaGroupRoleMapperTests.cs

@@ -28,6 +28,8 @@ public sealed class OtOpcUaGroupRoleMapperTests
         return new OtOpcUaGroupRoleMapper(options, new FakeMappingService(dbRows));
     }
 
+    /// <summary>Verifies that the mapper maps a configured group and drops unmapped groups.</summary>
+    /// <returns>A task that represents the asynchronous test operation.</returns>
     [Fact]
     public async Task Maps_config_group_and_drops_unmapped_group()
     {
@@ -39,6 +41,8 @@ public sealed class OtOpcUaGroupRoleMapperTests
         result.Scope.ShouldBeNull();
     }
 
+    /// <summary>Verifies that a system-wide DB row adds a role on top of the config baseline.</summary>
+    /// <returns>A task that represents the asynchronous test operation.</returns>
     [Fact]
     public async Task System_wide_db_row_adds_role_on_top_of_config_baseline()
     {
@@ -53,6 +57,8 @@ public sealed class OtOpcUaGroupRoleMapperTests
         result.Scope.ShouldBeNull();
     }
 
+    /// <summary>Verifies that a cluster-scoped DB row is ignored by the mapper.</summary>
+    /// <returns>A task that represents the asynchronous test operation.</returns>
     [Fact]
     public async Task Cluster_scoped_db_row_is_ignored()
     {
@@ -72,6 +78,8 @@ public sealed class OtOpcUaGroupRoleMapperTests
         result.Roles.ShouldBeEmpty();
     }
 
+    /// <summary>Verifies that the mapper output matches the expected RoleMapper.Map + Merge result for representative inputs.</summary>
+    /// <returns>A task that represents the asynchronous test operation.</returns>
     [Fact]
     public async Task Reproduces_RoleMapper_Map_plus_Merge_for_representative_inputs()
     {
@@ -102,16 +110,31 @@ public sealed class OtOpcUaGroupRoleMapperTests
     /// <summary>In-memory stand-in for the EF-backed DB service; returns the configured rows verbatim.</summary>
     private sealed class FakeMappingService(IReadOnlyList<LdapGroupRoleMapping> rows) : ILdapGroupRoleMappingService
     {
+        /// <summary>Returns all seeded rows that belong to any of the specified LDAP groups.</summary>
+        /// <param name="ldapGroups">The LDAP groups to look up.</param>
+        /// <param name="cancellationToken">The cancellation token.</param>
+        /// <returns>A task that resolves to the matching role mappings.</returns>
         public Task<IReadOnlyList<LdapGroupRoleMapping>> GetByGroupsAsync(
             IEnumerable<string> ldapGroups, CancellationToken cancellationToken)
             => Task.FromResult(rows);
 
+        /// <summary>Returns all seeded role mapping rows.</summary>
+        /// <param name="cancellationToken">The cancellation token.</param>
+        /// <returns>A task that resolves to all role mappings.</returns>
         public Task<IReadOnlyList<LdapGroupRoleMapping>> ListAllAsync(CancellationToken cancellationToken)
             => Task.FromResult(rows);
 
+        /// <summary>Not supported in this stub.</summary>
+        /// <param name="row">The row to create.</param>
+        /// <param name="cancellationToken">The cancellation token.</param>
+        /// <returns>Never returns; always throws.</returns>
         public Task<LdapGroupRoleMapping> CreateAsync(LdapGroupRoleMapping row, CancellationToken cancellationToken)
             => throw new NotSupportedException();
 
+        /// <summary>Not supported in this stub.</summary>
+        /// <param name="id">The identifier of the row to delete.</param>
+        /// <param name="cancellationToken">The cancellation token.</param>
+        /// <returns>Never returns; always throws.</returns>
         public Task DeleteAsync(Guid id, CancellationToken cancellationToken)
             => throw new NotSupportedException();
     }