fix(site-secrets): prune secret_mirror_status rows of decommissioned or renamed nodes

Each node now re-writes its mirror-status row every SecretMirrorStatusRefreshInterval
(10 min) as a heartbeat; SecretMirrorStatusReporter leaves off the health report and
deletes any row not refreshed for SecretMirrorStatusStaleAfter (1 h, validated >= 2x the
refresh). The delete is conditional on the checked_at it read, so a node that came back
keeps its fresh row; a returning node re-writes its row on its first pass.

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/SiteRuntimeOptionsValidator.cs

@@ -136,5 +136,13 @@ public sealed class SiteRuntimeOptionsValidator : OptionsValidatorBase<SiteRunti
             $"ScadaBridge:SiteRuntime:DeployedSecretsMirrorInterval must be a positive duration " +
             $"(was {options.DeployedSecretsMirrorInterval}); it is the DeployedSecretsMirror " +
             "reconcile PeriodicTimer period.");
+        builder.RequireThat(options.SecretMirrorStatusRefreshInterval > TimeSpan.Zero,
+            $"ScadaBridge:SiteRuntime:SecretMirrorStatusRefreshInterval must be a positive duration " +
+            $"(was {options.SecretMirrorStatusRefreshInterval}); it is how often each node re-writes its " +
+            "secret_mirror_status row.");
+        builder.RequireThat(options.SecretMirrorStatusStaleAfter >= options.SecretMirrorStatusRefreshInterval * 2,
+            $"ScadaBridge:SiteRuntime:SecretMirrorStatusStaleAfter (was {options.SecretMirrorStatusStaleAfter}) must be " +
+            $"at least twice SecretMirrorStatusRefreshInterval (was {options.SecretMirrorStatusRefreshInterval}); " +
+            "otherwise a live node's row could be pruned between two refreshes.");
     }
 }