docs(src): add missing XML docs and strip tracking-ID comments

Sweep of 203 source files resolving CommentChecker findings: add
<summary>/<param>/<returns>/<inheritdoc> where missing, and remove
resolved task/issue tracking markers (Tests-NNN, Worker-NNN, Server-NNN,
Task N) from code comments. Comment/doc-only — no logic changes.
Server+Tests build clean under TreatWarningsAsErrors.

src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/DashboardApiKeyManagementServiceTests.cs

@@ -29,6 +29,7 @@ public sealed class DashboardApiKeyManagementServiceTests : IDisposable
     private readonly List<TempDatabaseDirectory> _tempDirectories = [];
 
     /// <summary>Verifies that unauthorized users cannot create API keys.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task CreateAsync_UnauthorizedUser_DoesNotCreate()
     {
@@ -45,6 +46,7 @@ public sealed class DashboardApiKeyManagementServiceTests : IDisposable
     }
 
     /// <summary>Verifies that authorized users create a verifiable, constrained key and audit it.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task CreateAsync_AuthorizedUser_CreatesVerifiableKeyAndAudits()
     {
@@ -79,6 +81,7 @@ public sealed class DashboardApiKeyManagementServiceTests : IDisposable
     }
 
     /// <summary>Verifies that creating a key whose id already exists is rejected.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task CreateAsync_DuplicateKeyId_ReportsConflict()
     {
@@ -96,6 +99,7 @@ public sealed class DashboardApiKeyManagementServiceTests : IDisposable
     }
 
     /// <summary>Verifies that authorized users can revoke keys with audit trail.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task RevokeAsync_AuthorizedUser_RevokesAndAudits()
     {
@@ -121,6 +125,7 @@ public sealed class DashboardApiKeyManagementServiceTests : IDisposable
     }
 
     /// <summary>Verifies that authorized users can rotate a key's secret with audit trail.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task RotateAsync_AuthorizedUser_RotatesAndAudits()
     {
@@ -153,6 +158,7 @@ public sealed class DashboardApiKeyManagementServiceTests : IDisposable
     }
 
     /// <summary>Verifies that authorized users can delete revoked keys with audit trail.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task DeleteAsync_AuthorizedUser_DeletesRevokedKeyAndAudits()
     {
@@ -181,6 +187,7 @@ public sealed class DashboardApiKeyManagementServiceTests : IDisposable
     /// <c>dashboard-delete-key</c> audit entry with <c>Details = "not-found-or-active"</c> is still
     /// written — audit completeness for refused deletes.
     /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task DeleteAsync_ActiveKey_ReportsFriendlyErrorAndAudits()
     {
@@ -206,6 +213,7 @@ public sealed class DashboardApiKeyManagementServiceTests : IDisposable
 
     /// <summary>A blank key id fails validation before any store or audit call runs.</summary>
     /// <param name="blankKeyId">A blank or whitespace key identifier.</param>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Theory]
     [InlineData("")]
     [InlineData(" ")]
@@ -225,10 +233,11 @@ public sealed class DashboardApiKeyManagementServiceTests : IDisposable
     }
 
     /// <summary>
-    /// Server-004 regression: the dashboard create path must reject a request carrying a
+    /// The dashboard create path must reject a request carrying a
     /// non-canonical scope string rather than persisting a key whose scope the authorization
     /// resolver never matches.
     /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task CreateAsync_UnknownScope_DoesNotCreate()
     {
@@ -255,6 +264,7 @@ public sealed class DashboardApiKeyManagementServiceTests : IDisposable
     /// Phase 3 canonical audit shape: the dashboard-create-key canonical AuditEvent records
     /// the operator username as Actor and the managed keyId as Target.
     /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task CreateAsync_AuthorizedUser_CanonicalAuditEventHasOperatorAsActorAndKeyIdAsTarget()
     {
@@ -386,7 +396,10 @@ public sealed class DashboardApiKeyManagementServiceTests : IDisposable
         /// <summary>Gets the recorded canonical audit events.</summary>
         public List<ZB.MOM.WW.Audit.AuditEvent> Events { get; } = [];
 
-        /// <inheritdoc />
+        /// <summary>Records the audit event in memory instead of writing it to a real sink.</summary>
+        /// <param name="auditEvent">The audit event to record.</param>
+        /// <param name="cancellationToken">A token to observe for cancellation requests.</param>
+        /// <returns>A task that represents the asynchronous operation.</returns>
         public Task WriteAsync(ZB.MOM.WW.Audit.AuditEvent auditEvent, CancellationToken cancellationToken = default)
         {
             Events.Add(auditEvent);