docs: strip task-tracking IDs from code comments and fill missing XML docs

Tracking IDs are review bookkeeping that rots in shipped source; the rationale they tagged is kept. Comment-only change (CommentChecker 458 -> 16 false positives).

src/ZB.MOM.WW.MxGateway.Server/Dashboard/Hubs/AlarmsHub.cs

@@ -11,9 +11,9 @@ namespace ZB.MOM.WW.MxGateway.Server.Dashboard.Hubs;
 /// </summary>
 /// <remarks>
 /// The feed is galaxy-wide: the alarm monitor is gateway-central and its messages carry no
-/// session provenance, so the SEC-25 per-session tag ACL that scopes <c>EventsHub</c> has nothing
+/// session provenance, so the per-session tag ACL that scopes <c>EventsHub</c> has nothing
 /// to intersect here and is deliberately not applied — every authenticated Viewer sees the whole
-/// subscription expression's alarm metadata. What SEC-40 tightened instead is the entry gate:
+/// subscription expression's alarm metadata. What is tightened instead is the entry gate:
 /// <see cref="DashboardAuthenticationDefaults.AlarmsPolicy"/> rather than the
 /// <see cref="DashboardAuthenticationDefaults.HubClientsPolicy"/> the other hubs use, so the
 /// read-only environment bypasses (<c>Authentication:Mode=Disabled</c>, anonymous localhost) no

src/ZB.MOM.WW.MxGateway.Server/Dashboard/Hubs/AlarmsHubPublisher.cs

@@ -23,7 +23,7 @@ namespace ZB.MOM.WW.MxGateway.Server.Dashboard.Hubs;
 /// <c>StreamAlarms</c> subscribers and the alarms page as well, and none of
 /// those audiences is subject to this dashboard-display flag.
 /// <para>
-/// The broadcast stays deliberately unfiltered (SEC-40). Audience is decided once, at hub
+/// The broadcast stays deliberately unfiltered. Audience is decided once, at hub
 /// admission — <see cref="AlarmsHub"/> carries
 /// <see cref="DashboardAuthenticationDefaults.AlarmsPolicy"/>, so only an authenticated caller
 /// with a real dashboard role is ever in <see cref="AlarmsHub.AllAlarmsGroup"/> — and the alarm

src/ZB.MOM.WW.MxGateway.Server/Dashboard/Hubs/EventsHub.cs

@@ -39,8 +39,8 @@ public sealed class EventsHub(
     /// The hub-level <see cref="AuthorizeAttribute"/> (<c>HubClientsPolicy</c>)
     /// only checks that the caller carries one of the dashboard roles, which by
     /// itself would let any Viewer subscribe to any session id they name. The
-    /// per-session decision is <see cref="IDashboardSessionAcl"/>'s
-    /// (SEC-25 / TST-15). The admin bypass is evaluated first, so an
+    /// per-session decision is <see cref="IDashboardSessionAcl"/>'s.
+    /// The admin bypass is evaluated first, so an
     /// Administrator joins any session id they name; every check below it
     /// applies to non-Admin callers only. For those: a Viewer sees a session
     /// only when its tags intersect their granted tags, an untagged session
@@ -95,16 +95,12 @@ public sealed class EventsHub(
         viewerRegistry.RemoveViewer(Context.ConnectionId, sessionId);
     }
 
-    /// <summary>
-    /// Releases every session subscription the dropped connection held. A browser
-    /// tab that closes never calls <see cref="UnsubscribeSession"/>, so without
-    /// this the session would look watched forever and the mirror would keep
-    /// cloning and sending events to an empty group.
-    /// </summary>
-    /// <param name="exception">The exception that terminated the connection, if any.</param>
-    /// <returns>A task representing the disconnect handling.</returns>
+    /// <inheritdoc />
     public override Task OnDisconnectedAsync(Exception? exception)
     {
+        // Release every session subscription the dropped connection held. A browser tab that
+        // closes never calls UnsubscribeSession, so without this the session would look watched
+        // forever and the mirror would keep cloning and sending events to an empty group.
         viewerRegistry.ReleaseConnection(Context.ConnectionId);
 
         return base.OnDisconnectedAsync(exception);