fix(host): distinguish secret-store fault from missing PSK secret (review 2026-10-21 05/U2)

tests/ZB.MOM.WW.ScadaBridge.Host.Tests/SitePskProviderTests.cs

@@ -122,21 +122,22 @@ public class SitePskProviderTests
             async () => await Create(resolver).GetAsync("site-a", CancellationToken.None));
     }
 
-    /// <summary>Verifies that a faulting store surfaces as a key-not-configured error rather than a crypto error.</summary>
+    /// <summary>Verifies that a faulting store surfaces as a distinct store-unavailable error.</summary>
     /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]
-    public async Task AFaultingStore_SurfacesAsKeyNotConfigured_NotAsACryptoError()
+    public async Task AFaultingStore_SurfacesAsStoreUnavailable_NotAsMissingSecret()
     {
-        // A host with no master key throws from the resolver. The operator's problem is the
-        // same either way — "this site has no key" — so the diagnosis must say that.
+        // Review 2026-10-21 05/U2: a store fault must not read as "secret missing".
         var resolver = Substitute.For<ISecretResolver>();
         resolver.GetAsync(Arg.Any<SecretName>(), Arg.Any<CancellationToken>())
             .Returns<string?>(_ => throw new InvalidOperationException("no master key configured"));
 
-        var ex = await Assert.ThrowsAsync<InvalidOperationException>(
+        var ex = await Assert.ThrowsAsync<SecretStoreUnavailableException>(
             async () => await Create(resolver).GetAsync("site-a", CancellationToken.None));
 
         Assert.Contains("SB-GRPC-PSK-site-a", ex.Message);
+        Assert.Contains("store fault", ex.Message);
+        Assert.IsType<InvalidOperationException>(ex.InnerException);
     }
 
     /// <summary>Verifies that successful resolves are cached so not every call hits the store.</summary>