fix(site-secrets): report every site node's secret mirror failures on the health report (M1)

A DeployedSecretsMirror failure on the STANDBY node (e.g. a master-key mismatch
that stops a deployed secret decrypting there) was only logged on that node:
site health reports are sent by the active node only, so central never saw it.

- New 12th LocalDb-replicated table secret_mirror_status (node_name PK,
  failures_json of {SecretName, Message}, checked_at; no FKs). Each node's
  mirror writes only its own row, and only when its failure set changes plus
  once per start-up (every write replicates via CDC). Best-effort: a failed
  write is a Warning and is retried next pass. Node key = INodeIdentityProvider
  NodeName, falling back to the machine name.
- SecretMirrorStatusReporter (SiteRuntime, every node, 30 s) reads every row
  into ISiteHealthCollector.SetSecretMirrorStatuses -> additive nullable
  SiteHealthReport.SecretMirrorStatuses (null = no data).
- Wire: SiteHealthReportDto.secret_mirror_statuses = 33 (presence wrapper so
  null != empty); vendored CentralControl.cs regenerated; mapper both ways.
- Central UI Health card: 'Secret mirror failing' badge + compact per-node
  node / secret / message list.
- Tests: mirror status write-on-change/first-pass/failure isolation, storage
  round-trip, reporter/collector, DTO mapper round-trip incl. null/empty,
  bUnit, replicated-table set (twelve) + FK guard wording.

tests/ZB.MOM.WW.ScadaBridge.SiteRuntime.Tests/Persistence/SiteStorageSchemaTests.cs

@@ -23,14 +23,14 @@ public class SiteStorageSchemaTests
             SiteStorageSchema.Apply(connection);
             SiteStorageSchema.Apply(connection);   // second run must not throw
 
-            // Every table is named explicitly on purpose — a loop asserting "11 tables"
+            // Every table is named explicitly on purpose — a loop asserting "12 tables"
             // would still pass if one were renamed.
             foreach (var table in new[]
                      {
                          "deployed_configurations", "static_attribute_overrides", "shared_scripts",
                          "external_systems", "database_connections", "notification_lists",
                          "data_connection_definitions", "smtp_configurations", "native_alarm_state",
-                         "deployed_secrets", "mirrored_secrets",
+                         "deployed_secrets", "mirrored_secrets", "secret_mirror_status",
                      })
             {
                 Assert.True(TableExists(connection, table), $"missing table: {table}");