docs: complete XML doc comments via fixdocs (2757 to 131 findings)

Add missing <returns>/<param>/<summary>/<typeparam> tags and clean up
misused inheritdoc across 481 files so the documented API surface is
complete. Documentation-only (zero code lines changed). The 131 remaining
findings are inheritdoc-style warnings deliberately left to preserve
hand-written implementation rationale (plan-decision notes, race-condition
explanations).

tests/Server/ZB.MOM.WW.OtOpcUa.Security.Tests/OtOpcUaLdapAuthServiceTests.cs

@@ -22,6 +22,7 @@ public sealed class OtOpcUaLdapAuthServiceTests
         new(options, inner, NullLogger<OtOpcUaLdapAuthService>.Instance);
 
     /// <summary>DevStubMode on → stub Administrator success WITHOUT hitting the library.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task DevStubMode_grants_Administrator_without_calling_the_library()
     {
@@ -38,6 +39,7 @@ public sealed class OtOpcUaLdapAuthServiceTests
     }
 
     /// <summary>Enabled=false → denial, no library call (master switch wins over DevStubMode).</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task Disabled_denies_without_calling_the_library_even_with_devstub()
     {
@@ -53,6 +55,7 @@ public sealed class OtOpcUaLdapAuthServiceTests
 
     /// <summary>Real path: a library success surfaces its Groups; Roles are left empty for the
     /// downstream mapper (the library returns groups, not roles).</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task Real_path_success_surfaces_groups_and_leaves_roles_for_the_mapper()
     {
@@ -73,6 +76,7 @@ public sealed class OtOpcUaLdapAuthServiceTests
     }
 
     /// <summary>Real path: a library failure folds into a fail-closed error string.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task Real_path_failure_folds_into_error()
     {
@@ -90,6 +94,7 @@ public sealed class OtOpcUaLdapAuthServiceTests
 
     /// <summary>Insecure transport without AllowInsecure fails closed at the auth boundary WITHOUT
     /// reaching the library — preserving the bespoke service's login-time guard after UseTls→Transport.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task Insecure_transport_without_AllowInsecure_fails_closed_without_calling_library()
     {
@@ -107,6 +112,9 @@ public sealed class OtOpcUaLdapAuthServiceTests
     }
 
     /// <summary>Empty username/password are rejected up front without a library call.</summary>
+    /// <param name="user">The username to test.</param>
+    /// <param name="pw">The password to test.</param>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Theory]
     [InlineData("", "pw")]
     [InlineData("user", "")]
@@ -124,8 +132,14 @@ public sealed class OtOpcUaLdapAuthServiceTests
     /// <summary>Records whether the library service was invoked and returns a canned result.</summary>
     private sealed class RecordingLibService(LibLdapAuthResult result) : LibILdapAuthService
     {
+        /// <summary>Gets a value indicating whether the library service was called.</summary>
         public bool Called { get; private set; }
 
+        /// <summary>Authenticates the user, records that the call was made, and returns the canned result.</summary>
+        /// <param name="username">The username to authenticate.</param>
+        /// <param name="password">The password to authenticate.</param>
+        /// <param name="ct">Cancellation token for the operation.</param>
+        /// <returns>A task that resolves to the canned <see cref="LibLdapAuthResult"/>.</returns>
         public Task<LibLdapAuthResult> AuthenticateAsync(string username, string password, CancellationToken ct)
         {
             Called = true;