docs(src): add missing XML docs and strip tracking-ID comments

Sweep of 203 source files resolving CommentChecker findings: add
<summary>/<param>/<returns>/<inheritdoc> where missing, and remove
resolved task/issue tracking markers (Tests-NNN, Worker-NNN, Server-NNN,
Task N) from code comments. Comment/doc-only — no logic changes.
Server+Tests build clean under TreatWarningsAsErrors.

src/ZB.MOM.WW.MxGateway.Tests/Security/Authentication/ApiKeyAdminCliRunnerTests.cs

@@ -14,6 +14,7 @@ public sealed class ApiKeyAdminCliRunnerTests : IDisposable
 {
     private readonly List<TempDatabaseDirectory> _tempDirectories = [];
     /// <summary>Verifies that CreateKeyAsync creates an authenticating key and audits the action.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task CreateKeyAsync_CreatesAuthenticatingKeyAndAudits()
     {
@@ -52,6 +53,7 @@ public sealed class ApiKeyAdminCliRunnerTests : IDisposable
     }
 
     /// <summary>Verifies that ListKeysAsync does not print the raw secret.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task ListKeysAsync_DoesNotPrintRawSecret()
     {
@@ -82,6 +84,7 @@ public sealed class ApiKeyAdminCliRunnerTests : IDisposable
     }
 
     /// <summary>Verifies that RevokeKeyAsync causes the revoked key to fail verification and is audited.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task RevokeKeyAsync_RevokedKeyFailsVerificationAndAudits()
     {
@@ -117,6 +120,7 @@ public sealed class ApiKeyAdminCliRunnerTests : IDisposable
     }
 
     /// <summary>Verifies that RotateKeyAsync prints the new secret once and invalidates the old secret.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task RotateKeyAsync_PrintsNewSecretOnceAndInvalidatesOldSecret()
     {
@@ -154,6 +158,7 @@ public sealed class ApiKeyAdminCliRunnerTests : IDisposable
     }
 
     /// <summary>Verifies that CreateKeyAsync prints the raw secret exactly once.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task CreateKeyAsync_PrintsRawSecretExactlyOnce()
     {
@@ -182,6 +187,7 @@ public sealed class ApiKeyAdminCliRunnerTests : IDisposable
     }
 
     /// <summary>Verifies that API key constraints are persisted correctly.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task CreateKeyAsync_WithConstraints_PersistsConstraints()
     {

src/ZB.MOM.WW.MxGateway.Tests/Security/Authentication/ApiKeyAdminCommandLineParserTests.cs

@@ -53,7 +53,7 @@ public sealed class ApiKeyAdminCommandLineParserTests
     }
 
     /// <summary>
-    ///     Server-004 regression: a create-key command with a non-canonical scope
+    ///     A create-key command with a non-canonical scope
     ///     string (e.g. CLAUDE.md's stale <c>invoke</c> instead of <c>invoke:read</c>)
     ///     must be rejected at parse time rather than silently persisting an
     ///     unusable scope the authorization resolver never matches.

src/ZB.MOM.WW.MxGateway.Tests/Security/Authentication/ApiKeyVerifierTests.cs

@@ -18,6 +18,7 @@ public sealed class ApiKeyVerifierTests
     private static readonly ApiKeyOptions Options = new() { TokenPrefix = "mxgw" };
 
     /// <summary>Verifies that VerifyAsync returns identity and scopes for a valid key.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task VerifyAsync_ValidKey_ReturnsIdentityAndScopes()
     {
@@ -38,6 +39,7 @@ public sealed class ApiKeyVerifierTests
     }
 
     /// <summary>Verifies that VerifyAsync does not expose the raw secret in the result.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task VerifyAsync_ValidKey_DoesNotExposeRawSecretInResult()
     {
@@ -55,6 +57,7 @@ public sealed class ApiKeyVerifierTests
 
     /// <summary>Verifies that VerifyAsync fails as missing/malformed for a malformed key.</summary>
     /// <param name="authorizationHeader">Authorization header value to test.</param>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Theory]
     [InlineData("")]
     [InlineData("Bearer mxgw_operator01")]
@@ -72,6 +75,7 @@ public sealed class ApiKeyVerifierTests
     }
 
     /// <summary>Verifies that VerifyAsync fails for an unknown key.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task VerifyAsync_UnknownKey_Fails()
     {
@@ -86,6 +90,7 @@ public sealed class ApiKeyVerifierTests
     }
 
     /// <summary>Verifies that VerifyAsync fails for a wrong secret (constant-time compare rejects it).</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task VerifyAsync_WrongSecret_Fails()
     {
@@ -102,6 +107,7 @@ public sealed class ApiKeyVerifierTests
     }
 
     /// <summary>Verifies that VerifyAsync fails for a revoked key.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task VerifyAsync_RevokedKey_Fails()
     {
@@ -118,6 +124,7 @@ public sealed class ApiKeyVerifierTests
     }
 
     /// <summary>Verifies that VerifyAsync fails closed when the pepper is missing.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task VerifyAsync_MissingPepper_Fails()
     {
@@ -160,6 +167,7 @@ public sealed class ApiKeyVerifierTests
     private sealed class FakePepperProvider(string? pepper) : IApiKeyPepperProvider
     {
         /// <summary>Returns the configured pepper (or null to simulate an unavailable pepper).</summary>
+        /// <returns>The configured pepper, or null to simulate an unavailable pepper.</returns>
         public string? GetPepper() => pepper;
     }
 
@@ -169,13 +177,19 @@ public sealed class ApiKeyVerifierTests
         /// <summary>Gets whether the key was marked as used.</summary>
         public bool MarkedUsed { get; private set; }
 
-        /// <inheritdoc />
+        /// <summary>Returns the fake's single stored key if its ID matches, regardless of revocation.</summary>
+        /// <param name="keyId">Key ID to look up.</param>
+        /// <param name="ct">Cancellation token.</param>
+        /// <returns>The matching stored key record, or null if no key matches.</returns>
         public Task<ApiKeyRecord?> FindByKeyIdAsync(string keyId, CancellationToken ct)
         {
             return Task.FromResult(storedKey?.KeyId == keyId ? storedKey : null);
         }
 
-        /// <inheritdoc />
+        /// <summary>Returns the fake's single stored key if its ID matches and it has not been revoked.</summary>
+        /// <param name="keyId">Key ID to look up.</param>
+        /// <param name="ct">Cancellation token.</param>
+        /// <returns>The matching, non-revoked stored key record, or null otherwise.</returns>
         public Task<ApiKeyRecord?> FindActiveByKeyIdAsync(string keyId, CancellationToken ct)
         {
             return Task.FromResult(
@@ -184,7 +198,11 @@ public sealed class ApiKeyVerifierTests
                     : null);
         }
 
-        /// <inheritdoc />
+        /// <summary>Records that the stored key was used, exposed via <see cref="MarkedUsed"/> for assertions.</summary>
+        /// <param name="keyId">Key ID that was used.</param>
+        /// <param name="whenUtc">Timestamp of use (unused by the fake).</param>
+        /// <param name="ct">Cancellation token.</param>
+        /// <returns>A task that represents the asynchronous operation.</returns>
         public Task MarkUsedAsync(string keyId, DateTimeOffset whenUtc, CancellationToken ct)
         {
             MarkedUsed = storedKey?.KeyId == keyId;

src/ZB.MOM.WW.MxGateway.Tests/Security/Authentication/SqliteAuthStoreTests.cs

@@ -23,6 +23,7 @@ public sealed class SqliteAuthStoreTests : IDisposable
     /// <summary>
     /// Verifies that MigrateAsync initializes the database schema at the donor's version (2).
     /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task MigrateAsync_EmptyDatabase_InitializesCurrentSchema()
     {
@@ -41,6 +42,7 @@ public sealed class SqliteAuthStoreTests : IDisposable
     /// <summary>
     /// Verifies that MigrateAsync migrates and is idempotent.
     /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task MigrateAsync_ExistingVersionZeroDatabase_MigratesIdempotently()
     {
@@ -61,6 +63,7 @@ public sealed class SqliteAuthStoreTests : IDisposable
     /// <summary>
     /// Verifies that gateway startup fails with a newer schema version.
     /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task StartAsync_NewerSchemaVersion_BlocksStartup()
     {
@@ -83,6 +86,7 @@ public sealed class SqliteAuthStoreTests : IDisposable
     /// Verifies that FindActiveByKeyIdAsync returns an active key, reading a row whose columns match
     /// the donor schema (peppered secret_hash BLOB, ordinal-sorted scopes JSON).
     /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task FindActiveByKeyIdAsync_ExistingActiveKey_ReturnsKey()
     {
@@ -106,6 +110,7 @@ public sealed class SqliteAuthStoreTests : IDisposable
     /// <summary>
     /// Verifies that FindActiveByKeyIdAsync returns null for a revoked key.
     /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task FindActiveByKeyIdAsync_RevokedKey_ReturnsNull()
     {
@@ -129,6 +134,7 @@ public sealed class SqliteAuthStoreTests : IDisposable
     /// <summary>
     /// Verifies that the audit store persists audit events.
     /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task ApiKeyAuditStore_AppendAsync_PersistsAuditEvent()
     {
@@ -163,6 +169,7 @@ public sealed class SqliteAuthStoreTests : IDisposable
     /// the auth database in WAL journal mode so concurrent readers and writers degrade
     /// gracefully instead of surfacing <c>SQLITE_BUSY</c> on the request path.
     /// </summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
     public async Task OpenConnectionAsync_EnablesWalJournalModeAndBusyTimeout()
     {

src/ZB.MOM.WW.MxGateway.Tests/Security/Authentication/TempDatabaseDirectory.cs

@@ -22,6 +22,7 @@ internal sealed class TempDatabaseDirectory : IDisposable
 
     /// <summary>Creates a new uniquely named temporary directory under the given prefix.</summary>
     /// <param name="prefix">Folder name placed under <c>%TEMP%</c> to group related test directories.</param>
+    /// <returns>The created temporary directory handle.</returns>
     public static TempDatabaseDirectory Create(string prefix)
     {
         string path = System.IO.Path.Combine(
@@ -35,12 +36,13 @@ internal sealed class TempDatabaseDirectory : IDisposable
 
     /// <summary>Returns a database file path inside this temporary directory.</summary>
     /// <param name="fileName">Database file name; defaults to the gateway auth database name.</param>
+    /// <returns>The full path to the database file.</returns>
     public string DatabasePath(string fileName = "gateway-auth.db")
     {
         return System.IO.Path.Combine(Path, fileName);
     }
 
-    /// <inheritdoc />
+    /// <summary>Clears pooled SQLite connections and deletes the temporary directory.</summary>
     public void Dispose()
     {
         if (_disposed)