feat(site): DeployedSecretsMirror — per-node apply + decrypt-verify of deployed secrets

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/SiteRuntimeOptions.cs

@@ -263,4 +263,15 @@ public class SiteRuntimeOptions
     /// allow-listed roots and per-read size cap. Off by default (no roots).
     /// </summary>
     public Scripts.ScriptFileAccessOptions ScriptFileAccess { get; set; } = new();
+
+    /// <summary>
+    /// Interval at which <see cref="Secrets.DeployedSecretsMirror"/> reconciles the
+    /// site-wide, LocalDb-replicated <c>deployed_secrets</c> table into THIS node's own
+    /// <c>ZB.MOM.WW.Secrets</c> store — applying live rows, deleting rows this node
+    /// previously mirrored that are now tombstoned, and trial-decrypting every live row to
+    /// verify it resolves under this node's own master key. The reconcile also runs once
+    /// immediately at hosted-service start, so this interval only governs the steady-state
+    /// cadence. Default: 15 seconds.
+    /// </summary>
+    public TimeSpan DeployedSecretsMirrorInterval { get; set; } = TimeSpan.FromSeconds(15);
 }