feat(secrets)!: retire the gRPC secrets hub in ScadaBridge — sites get secrets via Deploy Artifacts; rig central on the shared SQL store

src/ZB.MOM.WW.ScadaBridge.Host/StartupValidator.cs

@@ -26,6 +26,13 @@ public static class StartupValidator
 
         var seedNodes = configuration.GetSection("ScadaBridge:Cluster:SeedNodes").Get<List<string>>();
 
+        // Secrets replication (the gRPC hub, and the SQL-Server ReplicatingSecretStore mode that
+        // preceded it) is retired in ScadaBridge (Task 11) — sites receive secrets exclusively via
+        // Deploy Artifacts, and a replicated site store would publish DeployedSecretsMirror's local
+        // deletes fleet-wide. Checked unconditionally (both roles): a Site used to be the gRPC
+        // hub's follower half, so the flag was never Central-only.
+        var secretsReplicationEnabled = configuration.GetValue<bool>("Secrets:Replication:Enabled");
+
         // GrpcPort: default 8083 when absent; only fails the range rule when the key is
         // present AND invalid. The out-param assignment mirrors the original so the
         // resolved grpcPort feeds the cross-field rules even on a parse failure.
@@ -49,6 +56,12 @@ public static class StartupValidator
             .Require("ScadaBridge:Node:RemotingPort",
                 _ => portValid,
                 "must be 1-65535")
+            // Retired for BOTH roles (Task 11) — a Site could set this too, as the gRPC hub's
+            // follower half. Deliberately NOT folded into a role-scoped block below.
+            .Require("Secrets:Replication:Enabled",
+                _ => !secretsReplicationEnabled,
+                "Secrets replication (the gRPC hub) is retired in ScadaBridge — sites receive "
+                + "secrets with Deploy Artifacts; central uses Secrets:Store:Provider=SqlServer")
             // SiteId (Site only) — note: OUTSIDE the big Site block in the original,
             // so it must run before the unconditional SeedNodes-count rule.
             .When(role == "Site", p => p
@@ -238,7 +251,6 @@ public static class StartupValidator
         var seedNodes = configuration.GetSection("ScadaBridge:Cluster:SeedNodes").Get<List<string>>();
         var provider = InboundApiKeyStoreOptions.ReadProvider(configuration);
         var secretsStoreProvider = configuration["Secrets:Store:Provider"];
-        var secretsReplicationEnabled = configuration.GetValue<bool>("Secrets:Replication:Enabled");
         var isClusteredCentral = role == "Central" && seedNodes is { Count: >= 2 };
 
         var warnings = new List<string>();
@@ -257,15 +269,13 @@ public static class StartupValidator
         // both central nodes to deploy the SAME secret set; a per-node store means each node has
         // silently drifted the moment anyone edits a secret on only one of them.
         //
-        // Gated off when Secrets:Replication:Enabled is true (review round 1, finding #1): that
-        // flag already puts this central node on a topology that shares state across the pair —
-        // the pre-existing gRPC hub (whose OWN central-side store is the shared SQL-Server store,
-        // not per-node SQLite — see SecretsRegistration's Grpc branch) or SQL-Server replication
-        // (ReplicatingSecretStore). Firing this warning there would be a false positive against
-        // the design's own named production topology (scadaproj#3), telling an operator to set a
-        // key that is already functionally moot.
+        // No Secrets:Replication:Enabled gate here any more (Task 11): that flag is now a hard
+        // Validate() failure on either role (the gRPC hub and SQL-Server secrets replication are
+        // both retired), so CollectWarnings never runs with it true on a config that also passed
+        // Validate — the old gate that suppressed this warning when replication was on is dead code
+        // and would otherwise mask the exact per-node-drift risk it exists to catch on any caller
+        // that invokes CollectWarnings directly.
         if (isClusteredCentral
-            && !secretsReplicationEnabled
             && !string.Equals(secretsStoreProvider, "SqlServer", StringComparison.OrdinalIgnoreCase))
         {
             warnings.Add(