docs: strip task-tracking IDs from code comments and fill missing XML docs

Tracking IDs are review bookkeeping that rots in shipped source; the rationale they tagged is kept. Comment-only change (CommentChecker 458 -> 16 false positives).

src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardAuthenticationDefaults.cs

@@ -35,7 +35,7 @@ public static class DashboardAuthenticationDefaults
 
     /// <summary>
     /// Policy guarding the alarm feed — the <c>AlarmsHub</c> SignalR surface and the
-    /// <c>/alarms</c> page that reads the same central monitor in process (SEC-40). Accepts the
+    /// <c>/alarms</c> page that reads the same central monitor in process. Accepts the
     /// same two schemes as <see cref="HubClientsPolicy"/> but carries
     /// <see cref="AuthenticatedDashboardRoleRequirement"/>, a requirement type
     /// <see cref="DashboardAuthorizationHandler"/> does not handle, so the environment bypasses
@@ -49,10 +49,10 @@ public static class DashboardAuthenticationDefaults
     public const string KeyPrefixClaimType = "mxgateway:key_prefix";
 
     /// <summary>
-    /// Claim carrying one dashboard event-visibility tag the caller is granted (SEC-25). Stamped
+    /// Claim carrying one dashboard event-visibility tag the caller is granted. Stamped
     /// at cookie login by <see cref="DashboardAuthenticator"/> and at hub-token mint by
     /// <see cref="HubTokenService"/>, both resolving the caller's LDAP groups through
-    /// <c>MxGateway:Dashboard:GroupToTag</c>. Since SEC-41 <see cref="IDashboardSessionAcl"/> reads
+    /// <c>MxGateway:Dashboard:GroupToTag</c>. <see cref="IDashboardSessionAcl"/> reads
     /// this claim only as a FALLBACK, for a principal that carries no
     /// <see cref="LdapGroupClaimType"/> claims to re-resolve from (the hub-token principal, whose
     /// payload carries tags but not groups); a cookie principal is re-resolved against current