fix(site-secrets): report every site node's secret mirror failures on the health report (M1)

A DeployedSecretsMirror failure on the STANDBY node (e.g. a master-key mismatch
that stops a deployed secret decrypting there) was only logged on that node:
site health reports are sent by the active node only, so central never saw it.

- New 12th LocalDb-replicated table secret_mirror_status (node_name PK,
  failures_json of {SecretName, Message}, checked_at; no FKs). Each node's
  mirror writes only its own row, and only when its failure set changes plus
  once per start-up (every write replicates via CDC). Best-effort: a failed
  write is a Warning and is retried next pass. Node key = INodeIdentityProvider
  NodeName, falling back to the machine name.
- SecretMirrorStatusReporter (SiteRuntime, every node, 30 s) reads every row
  into ISiteHealthCollector.SetSecretMirrorStatuses -> additive nullable
  SiteHealthReport.SecretMirrorStatuses (null = no data).
- Wire: SiteHealthReportDto.secret_mirror_statuses = 33 (presence wrapper so
  null != empty); vendored CentralControl.cs regenerated; mapper both ways.
- Central UI Health card: 'Secret mirror failing' badge + compact per-node
  node / secret / message list.
- Tests: mirror status write-on-change/first-pass/failure isolation, storage
  round-trip, reporter/collector, DTO mapper round-trip incl. null/empty,
  bUnit, replicated-table set (twelve) + FK guard wording.

tests/ZB.MOM.WW.ScadaBridge.Host.Tests/SiteLocalDbWiringTests.cs

@@ -254,7 +254,7 @@ public class SiteLocalDbWiringTests : IDisposable
             "deployed_configurations", "static_attribute_overrides", "shared_scripts",
             "external_systems", "database_connections", "notification_lists",
             "data_connection_definitions", "smtp_configurations", "native_alarm_state",
-            "deployed_secrets", "mirrored_secrets",
+            "deployed_secrets", "mirrored_secrets", "secret_mirror_status",
         })
         {
             Assert.Contains(table, tables);
@@ -262,9 +262,10 @@ public class SiteLocalDbWiringTests : IDisposable
     }
 
     [Fact]
-    public void Site_LocalDb_RegistersExactlyTheElevenReplicatedTables()
+    public void Site_LocalDb_RegistersExactlyTheTwelveReplicatedTables()
     {
-        // The Phase 2 cutover, extended by site-secrets artifact deploy's deployed_secrets.
+        // The Phase 2 cutover, extended by site-secrets artifact deploy's deployed_secrets
+        // and review finding M1's per-node secret_mirror_status.
         // This is an EXACTLY check rather than a Contains in both directions, and both
         // directions are load-bearing.
         //
@@ -285,8 +286,8 @@ public class SiteLocalDbWiringTests : IDisposable
                 // data_connection_definitions precedes database_connections.
                 "OperationTracking", "data_connection_definitions", "database_connections",
                 "deployed_configurations", "deployed_secrets", "external_systems",
-                "native_alarm_state", "sf_messages", "shared_scripts", "site_events",
-                "static_attribute_overrides",
+                "native_alarm_state", "secret_mirror_status", "sf_messages", "shared_scripts",
+                "site_events", "static_attribute_overrides",
             ],
             db.ReplicatedTables.Keys.OrderBy(k => k, StringComparer.Ordinal).ToArray());
     }
@@ -334,6 +335,7 @@ public class SiteLocalDbWiringTests : IDisposable
             ["instance_unique_name", "source_canonical_name", "source_reference"],
             db.ReplicatedTables["native_alarm_state"].PkColumns);
         Assert.Equal(["name"], db.ReplicatedTables["deployed_secrets"].PkColumns);
+        Assert.Equal(["node_name"], db.ReplicatedTables["secret_mirror_status"].PkColumns);
     }
 
     private static HashSet<string> TableNames(ILocalDb db)