fix(site-secrets): report every site node's secret mirror failures on the health report (M1)

A DeployedSecretsMirror failure on the STANDBY node (e.g. a master-key mismatch
that stops a deployed secret decrypting there) was only logged on that node:
site health reports are sent by the active node only, so central never saw it.

- New 12th LocalDb-replicated table secret_mirror_status (node_name PK,
  failures_json of {SecretName, Message}, checked_at; no FKs). Each node's
  mirror writes only its own row, and only when its failure set changes plus
  once per start-up (every write replicates via CDC). Best-effort: a failed
  write is a Warning and is retried next pass. Node key = INodeIdentityProvider
  NodeName, falling back to the machine name.
- SecretMirrorStatusReporter (SiteRuntime, every node, 30 s) reads every row
  into ISiteHealthCollector.SetSecretMirrorStatuses -> additive nullable
  SiteHealthReport.SecretMirrorStatuses (null = no data).
- Wire: SiteHealthReportDto.secret_mirror_statuses = 33 (presence wrapper so
  null != empty); vendored CentralControl.cs regenerated; mapper both ways.
- Central UI Health card: 'Secret mirror failing' badge + compact per-node
  node / secret / message list.
- Tests: mirror status write-on-change/first-pass/failure isolation, storage
  round-trip, reporter/collector, DTO mapper round-trip incl. null/empty,
  bUnit, replicated-table set (twelve) + FK guard wording.

src/ZB.MOM.WW.ScadaBridge.Commons/Messages/Health/SecretMirrorNodeStatus.cs

@@ -0,0 +1,26 @@
+namespace ZB.MOM.WW.ScadaBridge.Commons.Messages.Health;
+
+/// <summary>
+/// One site node's latest deployed-secrets mirror outcome, as carried on
+/// <see cref="SiteHealthReport.SecretMirrorStatuses"/> (review finding M1).
+/// </summary>
+/// <remarks>
+/// Every site node runs its own <c>DeployedSecretsMirror</c> and records its current
+/// failure set in the LocalDb-replicated <c>secret_mirror_status</c> table, keyed by node
+/// name; the ACTIVE node reads every row and ships them on its health report, so a
+/// STANDBY node's failures (most importantly a master-key mismatch that stops a deployed
+/// secret decrypting there) reach central before a failover exposes them. Carries names
+/// and human-readable messages only — never a secret value or ciphertext.
+/// </remarks>
+/// <param name="NodeName">The reporting node's semantic name (<c>node-a</c>/<c>node-b</c>), or its host name when unconfigured.</param>
+/// <param name="CheckedAtUtc">When that node last recorded a CHANGE in its failure set (or its first pass after start-up) — not the time of its latest pass.</param>
+/// <param name="Failures">That node's current mirror failures; empty when the node's mirror is healthy.</param>
+public sealed record SecretMirrorNodeStatus(
+    string NodeName,
+    DateTimeOffset CheckedAtUtc,
+    IReadOnlyList<SecretMirrorFailure> Failures);
+
+/// <summary>A single deployed secret that failed to apply and/or decrypt on one site node.</summary>
+/// <param name="SecretName">The secret's name.</param>
+/// <param name="Message">A human-readable failure message — never includes the secret's value.</param>
+public sealed record SecretMirrorFailure(string SecretName, string Message);

src/ZB.MOM.WW.ScadaBridge.Commons/Messages/Health/SiteHealthReport.cs

@@ -173,6 +173,20 @@ public record SiteHealthReport(
     /// </para>
     /// </remarks>
     public bool? StartupReconcilerActive { get; init; }
+
+    /// <summary>
+    /// Every site node's latest deployed-secrets mirror outcome (review finding M1) — one
+    /// entry per node that has recorded a row in the replicated <c>secret_mirror_status</c>
+    /// table, including the STANDBY node, whose own health report is never sent.
+    /// </summary>
+    /// <remarks>
+    /// <b>Null = no data</b>: a central self-report, a pre-M1 site build, a site whose
+    /// reporter has not run yet, or a failed read. An EMPTY list means the feature is wired
+    /// but no node has recorded a status yet. A node entry with an empty
+    /// <see cref="SecretMirrorNodeStatus.Failures"/> list is a healthy mirror. Names and
+    /// messages only — never secret values or ciphertext.
+    /// </remarks>
+    public IReadOnlyList<SecretMirrorNodeStatus>? SecretMirrorStatuses { get; init; }
 }
 
 /// <summary>