fix(host): follow an in-place site PSK rotation without a central restart (ScadaBridge#96)

SitePskProvider cached each site's gRPC preshared key forever; only site removal
invalidated it, so rotating SB-GRPC-PSK-{site} broke the central<->site link on
both central nodes until they restarted. The cached key is now dropped when:

- the secret is written through /admin/secrets: central replaces the secrets
  library's ISecretCacheInvalidator with SitePskRotationInvalidator, which also
  publishes SitePskInvalidated on a new DistributedPubSub topic
  (site-psk-invalidation) so the peer central node drops its copy and its
  resolver cache entry too (SitePskInvalidationSubscriber);
- a site rejects a central->site call with PermissionDenied/Unauthenticated:
  WithSiteCredentials wraps every per-site channel's handler in
  PskRejectionRefreshHandler, so the next call re-reads the key (covers
  out-of-process writes such as the secret CLI);
- a site->central call presents a token that does not match the cached key:
  CentralControlAuthInterceptor invalidates and re-reads once before refusing;
- ScadaBridge:Communication:SitePsks reloads.

Invalidation is case-insensitive because SecretName lowercases names. Rotation
runbook (topology-guide), Component-Communication/Host and the #85 cache audit
(D2) updated.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV

docs/requirements/Component-Communication.md

@@ -204,6 +204,18 @@ because sites are created at runtime and cannot be enumerated in configuration a
 `ControlPlaneCredentials` binds the key to the channel as `CallCredentials`, so no individual call
 site can omit it.
 
+Central caches each resolved key, and drops the entry (Gitea #96) when: the site is removed; the
+secret `SB-GRPC-PSK-<siteId>` is written through central's secrets write path (`/admin/secrets`) —
+`SitePskRotationInvalidator` wraps the secrets library's `ISecretCacheInvalidator` and also
+broadcasts a `SitePskInvalidated` on the central `DistributedPubSub` topic `site-psk-invalidation`
+so the peer central node drops its copy too; the site rejects a call with `PermissionDenied` /
+`Unauthenticated` (`PskRejectionRefreshHandler`, wrapped around every per-site channel by
+`WithSiteCredentials`, so the next call re-reads the key — this covers keys rotated outside the
+process, e.g. by the `secret` CLI, after at most the resolver's `Secrets:ResolveCacheTtl`); a
+site's inbound call to central presents a token that does not match the cached key
+(`CentralControlAuthInterceptor` drops the entry and re-reads once before refusing); or
+`ScadaBridge:Communication:SitePsks` reloads. An in-place rotation therefore needs no central restart.
+
 This is distinct from `LocalDb:Replication:ApiKey`, which gates
 `/localdb_sync.v1.LocalDbSync/` on the same listener via its own interceptor: that key
 authenticates the *pair partner* for database replication, a different trust relationship, and the