docs: complete XML-doc coverage and strip internal tracking IDs from code comments

Resolve all CommentChecker findings across the gateway server, worker, tests,
and .NET client (314 -> 0 real issues): add missing <returns>/<summary>/<param>
on public and test members, convert Stream/interface overrides to <inheritdoc/>,
and remove internal task/issue tracking IDs (SEC-*, IPC-*, WRK-*, GWC-*, TST-*,
Client.Dotnet-*) from shipped code documentation while preserving the design
rationale prose. Shipped comments should not carry internal bookkeeping, and
complete XML docs keep the analyzer/TreatWarningsAsErrors gate and generated API
docs clean. The 6 remaining flags are heuristic false positives (MD5, UTC-4,
capacity-1, near-1601) left intact so real documentation is not corrupted.

Claude-Session: https://claude.ai/code/session_01DMXXvNuPekkkrTEyPNxEkW

src/ZB.MOM.WW.MxGateway.Tests/Security/Authorization/GatewayGrpcAuthorizationInterceptorTests.cs

@@ -359,7 +359,7 @@ public sealed class GatewayGrpcAuthorizationInterceptorTests
     }
 
     /// <summary>
-    /// SEC-11: once a peer has exceeded the failure limit, the interceptor short-circuits with
+    /// Once a peer has exceeded the failure limit, the interceptor short-circuits with
     /// <see cref="StatusCode.ResourceExhausted"/> BEFORE calling the verifier, so an online guessing
     /// loop stops spending a store read per attempt. A verifier that always fails is used; after the
     /// limit is reached the verifier is no longer invoked.
@@ -404,7 +404,7 @@ public sealed class GatewayGrpcAuthorizationInterceptorTests
     }
 
     /// <summary>
-    /// SEC-11: a successful verification resets the peer's failure counter, so accumulated failures
+    /// A successful verification resets the peer's failure counter, so accumulated failures
     /// from a fat-fingered secret do not lock out a client that subsequently authenticates.
     /// </summary>
     /// <returns>A task that represents the asynchronous operation.</returns>