fix(site-secrets): prune secret_mirror_status rows of decommissioned or renamed nodes

Each node now re-writes its mirror-status row every SecretMirrorStatusRefreshInterval
(10 min) as a heartbeat; SecretMirrorStatusReporter leaves off the health report and
deletes any row not refreshed for SecretMirrorStatusStaleAfter (1 h, validated >= 2x the
refresh). The delete is conditional on the checked_at it read, so a node that came back
keeps its fresh row; a returning node re-writes its row on its first pass.

src/ZB.MOM.WW.ScadaBridge.Commons/Messages/Health/SecretMirrorNodeStatus.cs

@@ -13,7 +13,7 @@ namespace ZB.MOM.WW.ScadaBridge.Commons.Messages.Health;
 /// and human-readable messages only — never a secret value or ciphertext.
 /// </remarks>
 /// <param name="NodeName">The reporting node's semantic name (<c>node-a</c>/<c>node-b</c>), or its host name when unconfigured.</param>
-/// <param name="CheckedAtUtc">When that node last recorded a CHANGE in its failure set (or its first pass after start-up) — not the time of its latest pass.</param>
+/// <param name="CheckedAtUtc">When that node last wrote its row: on a CHANGE in its failure set, on its first pass after start-up, or on the periodic refresh (<c>SiteRuntime:SecretMirrorStatusRefreshInterval</c>, 10 min) — not the time of its latest pass. Rows older than <c>SecretMirrorStatusStaleAfter</c> are pruned.</param>
 /// <param name="Failures">That node's current mirror failures; empty when the node's mirror is healthy.</param>
 public sealed record SecretMirrorNodeStatus(
     string NodeName,