docs: strip task-tracking IDs from code comments and fill missing XML docs

Tracking IDs are review bookkeeping that rots in shipped source; the rationale they tagged is kept. Comment-only change (CommentChecker 458 -> 16 false positives).

src/ZB.MOM.WW.MxGateway.Server/Security/Audit/SqliteCanonicalAuditStore.cs

@@ -87,11 +87,9 @@ public sealed class SqliteCanonicalAuditStore(
     }
 
     /// <inheritdoc />
-    /// <remarks>
-    /// One connection, one transaction and one prepared command for the whole batch: the drain
-    /// pays a single commit for up to <see cref="AuditDrainService.MaxBatchSize"/> events rather
-    /// than one round-trip per event.
-    /// </remarks>
+    // One connection, one transaction and one prepared command for the whole batch: the drain
+    // pays a single commit for up to AuditDrainService.MaxBatchSize events rather
+    // than one round-trip per event.
     public async Task InsertBatchAsync(IReadOnlyList<AuditEvent> auditEvents, CancellationToken cancellationToken)
     {
         ArgumentNullException.ThrowIfNull(auditEvents);
@@ -148,17 +146,15 @@ public sealed class SqliteCanonicalAuditStore(
     }
 
     /// <inheritdoc />
-    /// <remarks>
-    /// The comparison goes through SQLite's <c>datetime()</c> rather than comparing the stored
-    /// ISO-8601 text directly. Text comparison is only correct while every row is UTC-normalized
-    /// ISO-8601 — which <see cref="AuditEvent.OccurredAtUtc"/> guarantees for rows written through
-    /// this store, but not for rows that entered the table any other way (a repair script, an
-    /// older schema, a future producer). On a mixed-format column a text comparison silently
-    /// deletes live audit: <c>2026-05-17T09:00:00-05:00</c> is two hours AFTER a
-    /// <c>2026-05-17T12:00:00+00:00</c> cutoff yet sorts before it. Comparing instants is correct
-    /// regardless of how the text got there, and anything <c>datetime()</c> cannot parse yields
-    /// NULL and is therefore never deleted — audit that cannot be dated is kept, not swept.
-    /// </remarks>
+    // The comparison goes through SQLite's datetime() rather than comparing the stored
+    // ISO-8601 text directly. Text comparison is only correct while every row is UTC-normalized
+    // ISO-8601 — which AuditEvent.OccurredAtUtc guarantees for rows written through
+    // this store, but not for rows that entered the table any other way (a repair script, an
+    // older schema, a future producer). On a mixed-format column a text comparison silently
+    // deletes live audit: 2026-05-17T09:00:00-05:00 is two hours AFTER a
+    // 2026-05-17T12:00:00+00:00 cutoff yet sorts before it. Comparing instants is correct
+    // regardless of how the text got there, and anything datetime() cannot parse yields
+    // NULL and is therefore never deleted — audit that cannot be dated is kept, not swept.
     public async Task<int> DeleteOlderThanAsync(DateTimeOffset cutoffUtc, CancellationToken cancellationToken)
     {
         await using SqliteConnection connection =