Add XML documentation across gateway, worker, and .NET client

src/MxGateway.Tests/Diagnostics/GatewayLogRedactorTests.cs

@@ -4,6 +4,7 @@ namespace MxGateway.Tests.Diagnostics;
 
 public sealed class GatewayLogRedactorTests
 {
+    /// <summary>Verifies that RedactApiKey preserves the key ID and removes the secret.</summary>
     [Fact]
     public void RedactApiKey_PreservesKeyIdAndRemovesSecret()
     {
@@ -13,6 +14,7 @@ public sealed class GatewayLogRedactorTests
         Assert.DoesNotContain("super-secret", redacted);
     }
 
+    /// <summary>Verifies that RedactApiKey removes secrets containing underscores.</summary>
     [Fact]
     public void RedactApiKey_RemovesSecretContainingUnderscores()
     {
@@ -22,6 +24,8 @@ public sealed class GatewayLogRedactorTests
         Assert.DoesNotContain("super_secret_value", redacted);
     }
 
+    /// <summary>Verifies that IsCredentialBearingCommand identifies credential-bearing MXAccess commands.</summary>
+    /// <param name="commandMethod">Name of the MXAccess command method.</param>
     [Theory]
     [InlineData("AuthenticateUser")]
     [InlineData("WriteSecured")]
@@ -31,6 +35,7 @@ public sealed class GatewayLogRedactorTests
         Assert.True(GatewayLogRedactor.IsCredentialBearingCommand(commandMethod));
     }
 
+    /// <summary>Verifies that RedactCommandValue does not log raw values by default.</summary>
     [Fact]
     public void RedactCommandValue_DoesNotLogRawValuesByDefault()
     {
@@ -39,6 +44,7 @@ public sealed class GatewayLogRedactorTests
         Assert.Equal("[redacted]", redacted);
     }
 
+    /// <summary>Verifies that RedactCommandValue redacts secured writes even when value logging is enabled.</summary>
     [Fact]
     public void RedactCommandValue_RedactsSecuredWriteEvenWhenValueLoggingIsEnabled()
     {
@@ -50,6 +56,7 @@ public sealed class GatewayLogRedactorTests
         Assert.Equal("[redacted]", redacted);
     }
 
+    /// <summary>Verifies that RedactCommandValue allows non-sensitive values only when value logging is enabled.</summary>
     [Fact]
     public void RedactCommandValue_AllowsNonSensitiveValueOnlyWhenValueLoggingIsEnabled()
     {
@@ -61,6 +68,7 @@ public sealed class GatewayLogRedactorTests
         Assert.Equal("diagnostic-value", redacted);
     }
 
+    /// <summary>Verifies that LogScope redacts client identity before scope state is created.</summary>
     [Fact]
     public void LogScope_RedactsClientIdentityBeforeScopeStateIsCreated()
     {