docs: strip task-tracking IDs from code comments and fill missing XML docs

Tracking IDs are review bookkeeping that rots in shipped source; the rationale they tagged is kept. Comment-only change (CommentChecker 458 -> 16 false positives).

src/ZB.MOM.WW.MxGateway.Server/Security/Authorization/GatewayGrpcAuthorizationInterceptor.cs

@@ -140,12 +140,17 @@ public sealed class GatewayGrpcAuthorizationInterceptor(
     // Token shape mxgw_<keyId>_<secret>: the key id is the second underscore-delimited segment (the
     // secret may itself contain underscores, which does not affect the key id). The shape is checked
     // before a key-id partition is minted so a spray of invented tokens cannot mint one tracked
-    // partition each and flush the limiter's bounded map (SEC-32). Anything that fails the check
+    // partition each and flush the limiter's bounded map. Anything that fails the check
     // falls back to the sender's transport-peer partition.
     //
     // Internal rather than private so the parse rules can be pinned directly by test; the shape
-    // check is a security boundary (SEC-32) and is worth asserting without routing every case
+    // check is a security boundary and is worth asserting without routing every case
     // through a full RPC.
+    /// <summary>
+    /// Extracts the API key id from a bearer authorization header.
+    /// </summary>
+    /// <param name="authorizationHeader">The raw <c>authorization</c> header value, or <see langword="null"/>.</param>
+    /// <returns>The key id when the header has the <c>mxgw_&lt;keyId&gt;_&lt;secret&gt;</c> shape; otherwise <see langword="null"/>.</returns>
     internal static string? TryResolveKeyId(string? authorizationHeader)
     {
         if (string.IsNullOrWhiteSpace(authorizationHeader))