docs: complete XML-doc coverage and strip internal tracking IDs from code comments

Resolve all CommentChecker findings across the gateway server, worker, tests,
and .NET client (314 -> 0 real issues): add missing <returns>/<summary>/<param>
on public and test members, convert Stream/interface overrides to <inheritdoc/>,
and remove internal task/issue tracking IDs (SEC-*, IPC-*, WRK-*, GWC-*, TST-*,
Client.Dotnet-*) from shipped code documentation while preserving the design
rationale prose. Shipped comments should not carry internal bookkeeping, and
complete XML docs keep the analyzer/TreatWarningsAsErrors gate and generated API
docs clean. The 6 remaining flags are heuristic false positives (MD5, UTC-4,
capacity-1, near-1601) left intact so real documentation is not corrupted.

Claude-Session: https://claude.ai/code/session_01DMXXvNuPekkkrTEyPNxEkW

src/ZB.MOM.WW.MxGateway.Tests/Security/Authentication/CachingApiKeyVerifierTests.cs

@@ -8,7 +8,7 @@ using LibApiKeyIdentity = ZB.MOM.WW.Auth.Abstractions.ApiKeys.ApiKeyIdentity;
 namespace ZB.MOM.WW.MxGateway.Tests.Security.Authentication;
 
 /// <summary>
-/// SEC-08 hot-path decorators. Covers both mechanisms: <see cref="CachingApiKeyVerifier"/>
+/// Hot-path decorators. Covers both mechanisms: <see cref="CachingApiKeyVerifier"/>
 /// (read/verification coalescing plus revoke/rotate invalidation) and
 /// <see cref="CoalescingMarkApiKeyStore"/> (the <c>last_used</c> write coalescing that keeps the
 /// per-RPC database write off the throughput ceiling).
@@ -18,6 +18,7 @@ public sealed class CachingApiKeyVerifierTests
     private const string Header = "Bearer mxgw_operator01_super-secret";
 
     /// <summary>A cache hit within the TTL returns the cached result and never calls the inner verifier.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task VerifyAsync_RepeatedWithinTtl_CallsInnerOnce()
     {
@@ -34,6 +35,7 @@ public sealed class CachingApiKeyVerifierTests
     }
 
     /// <summary>Different presented secrets are cached under distinct keys (no cross-secret aliasing).</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task VerifyAsync_DifferentTokens_NotAliased()
     {
@@ -48,6 +50,7 @@ public sealed class CachingApiKeyVerifierTests
     }
 
     /// <summary>Failed verifications are never cached; every attempt reaches the inner verifier.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task VerifyAsync_FailedVerification_NotCached()
     {
@@ -62,6 +65,7 @@ public sealed class CachingApiKeyVerifierTests
     }
 
     /// <summary>A TTL of zero disables caching: the inner verifier is called on every request.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task VerifyAsync_ZeroTtl_DisablesCache()
     {
@@ -76,6 +80,7 @@ public sealed class CachingApiKeyVerifierTests
     }
 
     /// <summary>Invalidating a key id (revoke/rotate) drops its cached verification, forcing a re-verify.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task Invalidate_DropsCachedEntry_ForcesReverify()
     {
@@ -96,6 +101,7 @@ public sealed class CachingApiKeyVerifierTests
     /// The store decorator coalesces repeated <c>MarkUsed</c> writes for the same key inside the
     /// window down to a single forwarded write — the ≤1/min guarantee for <c>last_used_utc</c>.
     /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task CoalescingStore_RepeatedMarksWithinWindow_ForwardsOnce()
     {
@@ -114,6 +120,7 @@ public sealed class CachingApiKeyVerifierTests
     }
 
     /// <summary>After the window elapses the next mark is forwarded again (staleness is bounded, not frozen).</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task CoalescingStore_AfterWindow_ForwardsAgain()
     {
@@ -129,6 +136,7 @@ public sealed class CachingApiKeyVerifierTests
     }
 
     /// <summary>Distinct keys are coalesced independently.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task CoalescingStore_DistinctKeys_TrackedSeparately()
     {
@@ -144,6 +152,7 @@ public sealed class CachingApiKeyVerifierTests
     }
 
     /// <summary>A zero window disables coalescing: every mark is forwarded.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task CoalescingStore_ZeroWindow_ForwardsEveryMark()
     {
@@ -173,8 +182,13 @@ public sealed class CachingApiKeyVerifierTests
 
     private sealed class FakeVerifier(ApiKeyVerification result) : IApiKeyVerifier
     {
+        /// <summary>Gets the number of times <see cref="VerifyAsync"/> has been called.</summary>
         public int CallCount { get; private set; }
 
+        /// <summary>Records the call and returns the fixed <paramref name="result"/> supplied at construction.</summary>
+        /// <param name="authorizationHeader">The authorization header presented by the caller.</param>
+        /// <param name="ct">A token to observe for cancellation.</param>
+        /// <returns>The fixed verification result.</returns>
         public Task<ApiKeyVerification> VerifyAsync(string authorizationHeader, CancellationToken ct)
         {
             CallCount++;
@@ -184,14 +198,28 @@ public sealed class CachingApiKeyVerifierTests
 
     private sealed class FakeStore : IApiKeyStore
     {
+        /// <summary>Gets the number of times <see cref="MarkUsedAsync"/> has been called.</summary>
         public int MarkUsedCount { get; private set; }
 
+        /// <summary>Always returns <see langword="null"/>; not exercised by these tests.</summary>
+        /// <param name="keyId">The key id to look up.</param>
+        /// <param name="ct">A token to observe for cancellation.</param>
+        /// <returns><see langword="null"/>.</returns>
         public Task<ApiKeyRecord?> FindByKeyIdAsync(string keyId, CancellationToken ct)
             => Task.FromResult<ApiKeyRecord?>(null);
 
+        /// <summary>Always returns <see langword="null"/>; not exercised by these tests.</summary>
+        /// <param name="keyId">The key id to look up.</param>
+        /// <param name="ct">A token to observe for cancellation.</param>
+        /// <returns><see langword="null"/>.</returns>
         public Task<ApiKeyRecord?> FindActiveByKeyIdAsync(string keyId, CancellationToken ct)
             => Task.FromResult<ApiKeyRecord?>(null);
 
+        /// <summary>Records the call by incrementing <see cref="MarkUsedCount"/>.</summary>
+        /// <param name="keyId">The key id that was used.</param>
+        /// <param name="whenUtc">The UTC timestamp of use.</param>
+        /// <param name="ct">A token to observe for cancellation.</param>
+        /// <returns>A task that represents the asynchronous operation.</returns>
         public Task MarkUsedAsync(string keyId, DateTimeOffset whenUtc, CancellationToken ct)
         {
             MarkUsedCount++;