feat(secrets): mount /admin/secrets + register secrets authz in CentralUI (ScadaBridge G-6 T7)

src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Layout/NavMenu.razor

@@ -18,6 +18,7 @@
                     <NavRailItem Href="/admin/ldap-mappings" Text="LDAP Mappings" />
                     <NavRailItem Href="/admin/sites" Text="Sites" />
                     <NavRailItem Href="/admin/api-keys" Text="API Keys" />
+                    <NavRailItem Href="/admin/secrets" Text="Secrets" />
                     @* Import Bundle requires Administrator only — Designer role is not sufficient.
                        Export Bundle lives in the Design section (RequireDesign). *@
                     <NavRailItem Href="/design/transport/import" Text="Import Bundle" />

src/ZB.MOM.WW.ScadaBridge.CentralUI/EndpointExtensions.cs

@@ -25,7 +25,9 @@ public static class EndpointExtensions
 
         endpoints.MapRazorComponents<TApp>()
             .AddInteractiveServerRenderMode()
-            .AddAdditionalAssemblies(typeof(MainLayout).Assembly);
+            .AddAdditionalAssemblies(
+                typeof(MainLayout).Assembly,
+                typeof(ZB.MOM.WW.Secrets.Ui.SecretsPage).Assembly);
 
         return endpoints;
     }

src/ZB.MOM.WW.ScadaBridge.CentralUI/ZB.MOM.WW.ScadaBridge.CentralUI.csproj

@@ -19,6 +19,7 @@
     <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Scripting" />
     <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Workspaces" />
     <PackageReference Include="ZB.MOM.WW.Theme" />
+    <PackageReference Include="ZB.MOM.WW.Secrets.Ui" />
   </ItemGroup>
 
   <ItemGroup>

src/ZB.MOM.WW.ScadaBridge.Host/Components/Routes.razor

@@ -1,6 +1,6 @@
 <CascadingAuthenticationState>
     <Router AppAssembly="typeof(Routes).Assembly"
-            AdditionalAssemblies="new[] { typeof(ZB.MOM.WW.ScadaBridge.CentralUI.Components.Layout.MainLayout).Assembly }">
+            AdditionalAssemblies="new[] { typeof(ZB.MOM.WW.ScadaBridge.CentralUI.Components.Layout.MainLayout).Assembly, typeof(ZB.MOM.WW.Secrets.Ui.SecretsPage).Assembly }">
         <Found Context="routeData">
             <AuthorizeRouteView RouteData="routeData" DefaultLayout="typeof(ZB.MOM.WW.ScadaBridge.CentralUI.Components.Layout.MainLayout)">
                 <NotAuthorized>

src/ZB.MOM.WW.ScadaBridge.Host/Program.cs

@@ -1,3 +1,4 @@
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.DependencyInjection.Extensions;
 using Microsoft.Extensions.Options;
@@ -31,6 +32,7 @@ using ZB.MOM.WW.Secrets.Abstractions;
 using ZB.MOM.WW.Secrets.Configuration;
 using ZB.MOM.WW.Secrets.DependencyInjection;
 using ZB.MOM.WW.Secrets.Sqlite;
+using ZB.MOM.WW.Secrets.Ui;
 using ZB.MOM.WW.Telemetry;
 using Serilog;
 
@@ -178,6 +180,14 @@ try
         builder.Services.AddSecurity(disableLogin);
         builder.Services.AddCentralUI();
         builder.Services.AddZbSecrets(builder.Configuration, "Secrets");
+        // Secrets UI authorization: adds the named policies secrets:manage + secrets:reveal
+        // (role-based) consumed by the /admin/secrets page. AddSecretsAuthorization only ADDS
+        // these two policies via Configure<AuthorizationOptions> — it composes additively with
+        // AddScadaBridgeAuthorization (invoked inside AddSecurity above) without clobbering.
+        // The library's AdminRole ("Administrator") satisfies both policies, and ScadaBridge
+        // builds identities with RoleClaimType = ZbClaimTypes.Role, so an Administrator is
+        // authorized for both manage + reveal. Done Host-side to keep Secrets.Ui out of Security.
+        builder.Services.Configure<AuthorizationOptions>(o => o.AddSecretsAuthorization());
         builder.Services.AddInboundAPI();
 
         // Inbound-API auth re-arch: the shared ZB.MOM.WW.Auth.ApiKeys verifier +