docs(src): add missing XML docs and strip tracking-ID comments

Sweep of 203 source files resolving CommentChecker findings: add
<summary>/<param>/<returns>/<inheritdoc> where missing, and remove
resolved task/issue tracking markers (Tests-NNN, Worker-NNN, Server-NNN,
Task N) from code comments. Comment/doc-only — no logic changes.
Server+Tests build clean under TreatWarningsAsErrors.

src/ZB.MOM.WW.MxGateway.Server/Dashboard/DashboardApiKeyManagementService.cs

@@ -20,17 +20,13 @@ public sealed class DashboardApiKeyManagementService(
     private const string UnauthorizedMessage = "Sign in with an authorized LDAP account to manage API keys.";
     private const string PepperUnavailableMarker = "pepper unavailable";
 
-    /// <summary>Determines whether the user can manage API keys.</summary>
-    /// <param name="user">The authenticated user principal.</param>
+    /// <inheritdoc />
     public bool CanManage(ClaimsPrincipal user)
     {
         return authorization.CanManage(user);
     }
 
-    /// <summary>Creates an API key asynchronously.</summary>
-    /// <param name="user">The authenticated user principal.</param>
-    /// <param name="request">The request payload.</param>
-    /// <param name="cancellationToken">Token to observe for cancellation.</param>
+    /// <inheritdoc />
     public async Task<DashboardApiKeyManagementResult> CreateAsync(
         ClaimsPrincipal user,
         DashboardApiKeyManagementRequest request,
@@ -82,10 +78,7 @@ public sealed class DashboardApiKeyManagementService(
         }
     }
 
-    /// <summary>Revokes an API key asynchronously.</summary>
-    /// <param name="user">The authenticated user principal.</param>
-    /// <param name="keyId">The API key identifier.</param>
-    /// <param name="cancellationToken">Token to observe for cancellation.</param>
+    /// <inheritdoc />
     public async Task<DashboardApiKeyManagementResult> RevokeAsync(
         ClaimsPrincipal user,
         string keyId,
@@ -120,10 +113,7 @@ public sealed class DashboardApiKeyManagementService(
             : DashboardApiKeyManagementResult.Fail("API key was not found or is already revoked.");
     }
 
-    /// <summary>Rotates an API key secret asynchronously.</summary>
-    /// <param name="user">The authenticated user principal.</param>
-    /// <param name="keyId">The API key identifier.</param>
-    /// <param name="cancellationToken">Token to observe for cancellation.</param>
+    /// <inheritdoc />
     public async Task<DashboardApiKeyManagementResult> RotateAsync(
         ClaimsPrincipal user,
         string keyId,
@@ -170,10 +160,7 @@ public sealed class DashboardApiKeyManagementService(
         }
     }
 
-    /// <summary>Deletes a revoked API key asynchronously.</summary>
-    /// <param name="user">The authenticated user principal.</param>
-    /// <param name="keyId">The API key identifier.</param>
-    /// <param name="cancellationToken">Token to observe for cancellation.</param>
+    /// <inheritdoc />
     public async Task<DashboardApiKeyManagementResult> DeleteAsync(
         ClaimsPrincipal user,
         string keyId,
@@ -242,15 +229,15 @@ public sealed class DashboardApiKeyManagementService(
 
     /// <summary>
     /// Emits the dashboard's own canonical <see cref="AuditEvent"/> for a <c>dashboard-*</c> op
-    /// directly through the best-effort <see cref="IAuditWriter"/> (Task 2.3 #6). This is in
+    /// directly through the best-effort <see cref="IAuditWriter"/>. This is in
     /// addition to the <c>create/revoke/rotate-key</c> event that <see cref="ApiKeyAdminCommands"/>
     /// emits via the canonical-forwarding <c>IApiKeyAuditStore</c> adapter — the doubled-audit
     /// behaviour is preserved, both rows now land in the canonical <c>audit_event</c> store.
     /// </summary>
     /// <remarks>
-    /// Phase 3 (Actor = operator principal): <c>Actor</c> is the LDAP operator who performed the
+    /// <c>Actor</c> is the LDAP operator who performed the
     /// action (resolved from the <paramref name="user"/> principal); <c>Target</c> is the managed
-    /// API key id. This fixes the pre-Phase-3 semantic gap where both fields held the keyId.
+    /// API key id. This fixes an earlier semantic gap where both fields held the keyId.
     /// </remarks>
     private async Task WriteDashboardAuditAsync(
         ClaimsPrincipal user,