Improve XML documentation coverage across src modules and sync generated analysis artifacts.

src/NATS.Server/Auth/AuthExtensionOptions.cs

@@ -2,6 +2,11 @@ namespace NATS.Server.Auth;
 
 public interface IExternalAuthClient
 {
+    /// <summary>
+    /// Requests an allow/deny decision from an external authentication provider.
+    /// </summary>
+    /// <param name="request">Credential material and identity hints from the client connection.</param>
+    /// <param name="ct">Cancellation token bound to auth timeout and connection lifecycle.</param>
     Task<ExternalAuthDecision> AuthorizeAsync(ExternalAuthRequest request, CancellationToken ct);
 }
 
@@ -19,14 +24,36 @@ public record ExternalAuthDecision(
 
 public sealed class ExternalAuthOptions
 {
+    /// <summary>
+    /// Gets or sets a value indicating whether external auth callouts are enabled.
+    /// </summary>
     public bool Enabled { get; set; }
+
+    /// <summary>
+    /// Gets or sets the timeout budget for each external auth decision request.
+    /// </summary>
     public TimeSpan Timeout { get; set; } = TimeSpan.FromSeconds(2);
+
+    /// <summary>
+    /// Gets or sets the client implementation responsible for external auth decisions.
+    /// </summary>
     public IExternalAuthClient? Client { get; set; }
 }
 
 public sealed class ProxyAuthOptions
 {
+    /// <summary>
+    /// Gets or sets a value indicating whether trusted-proxy authentication mode is enabled.
+    /// </summary>
     public bool Enabled { get; set; }
+
+    /// <summary>
+    /// Gets or sets the required username prefix marking identities provided by a trusted proxy.
+    /// </summary>
     public string UsernamePrefix { get; set; } = "proxy:";
+
+    /// <summary>
+    /// Gets or sets the default account to assign when proxy-authenticated users omit one.
+    /// </summary>
     public string? Account { get; set; }
 }