docs+ui: backfill XML doc comments and finish dashboard layout pass

Adds missing <summary>/<param> XML docs across 99 server, worker, and test
files so CommentChecker reports zero issues (TreatWarningsAsErrors needs the
analyzer clean). Bundles in WIP dashboard work: NavSection extraction,
MainLayout/site.css/js styling alignment, and DashboardOptions/Auth tweaks.

src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/DashboardAuthenticatorTests.cs

@@ -7,6 +7,7 @@ namespace ZB.MOM.WW.MxGateway.Tests.Gateway.Dashboard;
 
 public sealed class DashboardAuthenticatorTests
 {
+    /// <summary>Verifies that LDAP filter special characters are escaped correctly.</summary>
     [Fact]
     public void EscapeLdapFilter_EscapesSpecialCharacters()
     {
@@ -15,6 +16,9 @@ public sealed class DashboardAuthenticatorTests
         Assert.Equal("a\\5cb\\2ac\\28d\\29e\\00f", escaped);
     }
 
+    /// <summary>Verifies that group-to-role mapping resolves by short name and distinguished name.</summary>
+    /// <param name="ldapGroup">The LDAP group name or distinguished name.</param>
+    /// <param name="expectedRole">The expected role or null if no match.</param>
     [Theory]
     [InlineData("GwAdmin", DashboardRoles.Admin)]
     [InlineData("gwadmin", DashboardRoles.Admin)]
@@ -42,6 +46,7 @@ public sealed class DashboardAuthenticatorTests
         }
     }
 
+    /// <summary>Verifies that admin and viewer roles are both emitted when groups are present.</summary>
     [Fact]
     public void MapGroupsToRoles_AdminPlusViewer_BothRolesEmitted()
     {
@@ -59,6 +64,7 @@ public sealed class DashboardAuthenticatorTests
         Assert.Contains(DashboardRoles.Viewer, roles);
     }
 
+    /// <summary>Verifies that extraction returns the leading RDN value from a distinguished name.</summary>
     [Fact]
     public void ExtractFirstRdnValue_ReturnsLeadingRdnValue()
     {
@@ -68,6 +74,7 @@ public sealed class DashboardAuthenticatorTests
         Assert.Equal("Gateway Admins", result);
     }
 
+    /// <summary>Verifies that authentication fails when LDAP is disabled without exposing raw credentials.</summary>
     [Fact]
     public async Task AuthenticateAsync_LdapDisabled_ReturnsFailureWithoutRawCredentials()
     {