refactor: convention cleanup, unify AddToRole/RemoveFromRole error contract

[andregoepel]

Summary

Quick-fix cleanup pass from the convention audit (PR A of two — PR B, a
separate later effort, will normalize the test suite). Three commits:

1. Convention cleanup — deleted narrative/decorative/dead/non-English
   comments across src/ and compressed genuine one-line "why" rationale
   (a changelog-style comment in Register.razor, dead commented-out
   navigation in Email.razor, German comments/HTML-comment labels in
   several Manage pages, a duplicated 4-line comment repeated verbatim
   across 5 Blazor pages, two duplicated blocks in UserProjection.cs).
   Added sealed to RoleProjection, UserRoleAssignmentProjection,
   SetupRedirectMiddleware, CookieLoginMiddleware; narrowed
   CurrentUserService to internal sealed after confirming no consumer
   outside the assembly references the concrete type. Converted
   UserRoleAssignment to a sealed record. Blazor: added
   <AppPageTitle> to AccessDenied.razor, removed StateHasChanged()
   calls that are redundant given Blazor's automatic post-handler render,
   and replaced a throw-then-immediately-catch in Disable2fa.razor with
   direct branching.

2. Unify the AddToRole/RemoveFromRole error contract (the one
   behavior-affecting change to the public API) — UserStore.AddToRoleAsync
   and RemoveFromRoleAsync used to throw IdentityAuthorizationException
   on an authorization-denied condition, while every sibling store method
   (CreateAsync, DeleteAsync, RestoreAsync) returns
   IdentityResult.Failed for the equivalent condition.

   UserStore<TUser> now exposes public Task<IdentityResult>-returning
   AddToRoleAsync/RemoveFromRoleAsync overloads matching that pattern.
   This could not be done on the IUserRoleStore<TUser> interface members
   themselves — verified empirically that the framework interface only
   permits a plain Task return with no IdentityResult channel back
   through UserManager — so the explicit IUserRoleStore<TUser>
   implementation adapts a Failed result back into a throw, but only for
   hosts that drive role assignment through UserManager directly.
   IdentityAuthorizationException's doc comment now describes this
   narrower, adapter-only scope.

   Call sites updated:

   • UserInvitationService.InviteAsync — now loops over
     UserStore.AddToRoleAsync and checks .Succeeded instead of
     catching IdentityAuthorizationException around
     UserManager.AddToRolesAsync.
   • RoleUserDialog.razor (admin role-removal UI) — now calls
     UserStore.RemoveFromRoleAsync directly instead of
     UserManager.RemoveFromRoleAsync, so an authorization failure
     surfaces as the existing DialogService.Alert instead of an
     unhandled exception.
   • UserRoleDialog.razor (admin role-assignment UI) — now calls
     UserStore.AddToRoleAsync/RemoveFromRoleAsync directly instead of
     UserManager.AddToRolesAsync/RemoveFromRolesAsync, and now
     surfaces a failure via DialogService.Alert (new
     UserRoleDialog.ErrorTitle/RolesCouldNotBeSaved resource strings,
     en+de) — this dialog previously had no error handling at all for
     this operation.
   • UserStoreAuthorizationTests — the three tests that asserted
     Assert.ThrowsAsync<IdentityAuthorizationException> on
     AddToRoleAsync/RemoveFromRoleAsync now assert on the returned
     IdentityResult instead (AddToRoleAsync_NonAdminActor_Throws →
     ..._ReturnsNotAuthorized, etc.) — required by the contract change,
     scoped to only what item 6 needed.

   Also replaced the bare // IUserXxxStore section-header comments in
   UserStore.cs with #region/#endregion, matching the pattern
   already used in UserProjection.cs, and fixed the untyped
   throw new Exception("User not found") in the passkey read path to
   InvalidOperationException, matching the existing "role not found"
   pattern in the same file.

3. Cancellation fix — CleanupScheduleStartupService.StartAsync fired
   ApplyStoredScheduleAsync without awaiting it and without threading a
   CancellationToken, despite doing DB/scheduler I/O and the host
   already exposing IHostApplicationLifetime.ApplicationStopping.
   Threaded ApplicationStopping through, and wrapped the fire-and-forget
   invocation so an unobserved exception can no longer crash the process
   (existing log-and-swallow behavior preserved).

Notable judgment calls

• User.Passkeys HashSet TODO: left as Dictionary<string, UserPasskey>
  and just deleted the stale comment. The dictionary is keyed by
  credential id and queried via LINQ-to-Marten
  (x.Passkeys.Keys.Contains(...)); switching collection types would
  change serialization shape and query semantics against existing
  production data — not a safe, trivial change. Flagging as a possible
  future follow-up.
• PasskeyInputModel: evaluated for conversion to a record but kept
  as sealed class. No live usage was found anywhere in the codebase
  (looks like leftover/unused code), but its shape (two mutable string?
  properties, one of them an Error field meant to be set after the
  fact) matches this repo's documented "form models are mutable classes,
  not records" convention rather than an immutable DTO, so it was judged
  safer to keep as a class.

Test plan

• dotnet csharpier format . — clean, no outstanding diffs
• dotnet build — 0 errors, 91 pre-existing warnings (all in test
  files untouched by this PR — CS8625/xUnit1051), no new warnings
• dotnet test --filter "FullyQualifiedName!~E2ETests" — 413/413
  passed (191 unit + 130 Blazor + 92 integration; Docker was
  available so the Postgres-backed integration tests ran too)
• dotnet list package --vulnerable --include-transitive — no
  vulnerable packages
• Targeted re-run of UserStoreAuthorizationTests +
  UserInvitationServiceTests (16 tests) — all passed

Closes #143

🤖 Generated with Claude Code