refactor(host): remove legacy site-psk-invalidation topic (#105)

Removes the #96 compatibility path that the unified central-cache-invalidation
topic (#100 item 3, 153609ef; compat 3a31dd2d) carried for one release:
- CentralCacheInvalidationBus no longer publishes a bare SitePskInvalidated
  on site-psk-invalidation; LegacySitePskTopic constant deleted.
- CentralCacheInvalidationSubscriber no longer subscribes to that topic or
  handles a bare SitePskInvalidated; it applies envelopes only.
central-cache-invalidation behaviour is unchanged (one envelope per
invalidation, origin filtering, per-handler fault isolation).

Gate met: 8e32f353 (carries 153609ef and 3a31dd2d) runs on every central
node - DEV vd03 (record 581e25ca) and QA vq03/vq04 (record 8ba5d5d7).

Mixed-version / rolling-upgrade constraint: a central node built before
153609ef listens only on site-psk-invalidation and no longer receives PSK
invalidations from a newer peer (only its TTL and the site-rejection refresh
bound the staleness). Mixed pairs across that boundary are no longer
supported; central pairs are stopped and started together anyway.
Documented in Component-Host.md and Component-Communication.md.

Tests: the legacy publish/subscribe tests are replaced by
PskRotation_OnOneNode_ReachesThePeersCaches_ThroughTheUnifiedTopic (node A
publishes, node B's PSK cache and secret-resolver cache are invalidated, and
nothing else is published) and a bare-message-ignored test with an envelope
positive control. The two-node cluster test now asserts the PSK invalidation
arrives exactly once and the publisher applies nothing.

Claude-Session: https://claude.ai/code/session_01GT67ACmpMR7b9LGRPLijMi

tests/ZB.MOM.WW.ScadaBridge.Host.Tests/CentralCacheInvalidationBusTests.cs

@@ -44,7 +44,7 @@ public class CentralCacheInvalidationBusTests : TestKit
         var envelope = Assert.IsType<CentralCacheInvalidationEnvelope>(publish.Message);
         Assert.Equal(_bus.OriginId, envelope.OriginId);
         Assert.IsType<RoleMappingsInvalidated>(envelope.Invalidation);
-        mediator.ExpectNoMsg(TimeSpan.FromMilliseconds(100)); // only PSK also uses the legacy topic
+        mediator.ExpectNoMsg(TimeSpan.FromMilliseconds(100)); // one topic, one publish (#105)
     }
 
     /// <summary>Before the mediator exists publishing is a silent no-op.</summary>

tests/ZB.MOM.WW.ScadaBridge.Host.Tests/SitePskRotationInvalidatorTests.cs

@@ -26,8 +26,8 @@ public class SitePskRotationInvalidatorTests : TestKit
 
     /// <summary>
     /// Verifies that writing a site's PSK secret evicts the resolver cache, drops the site's
-    /// cached key and publishes the invalidation on the shared topic and, for a mixed-version
-    /// peer, bare on the legacy #96 topic.
+    /// cached key and publishes the invalidation once, on the shared topic only (the #96
+    /// <c>site-psk-invalidation</c> topic was removed in ScadaBridge#105).
     /// </summary>
     [Fact]
     public void WritingAPskSecret_DropsTheCachedKey_AndTellsThePeer()
@@ -46,9 +46,7 @@ public class SitePskRotationInvalidatorTests : TestKit
         var envelope = Assert.IsType<CentralCacheInvalidationEnvelope>(shared.Message);
         Assert.Equal(new SitePskInvalidated("site-a"), envelope.Invalidation);
         Assert.Equal(_bus.OriginId, envelope.OriginId);
-        var legacy = mediator.ExpectMsg<Publish>();
-        Assert.Equal("site-psk-invalidation", legacy.Topic);
-        Assert.Equal(new SitePskInvalidated("site-a"), legacy.Message);
+        mediator.ExpectNoMsg(TimeSpan.FromMilliseconds(200));
     }
 
     /// <summary>Negative control: any other secret only evicts the resolver cache.</summary>
@@ -101,18 +99,58 @@ public class SitePskRotationInvalidatorTests : TestKit
     }
 
     /// <summary>
-    /// Migration: a bare <see cref="SitePskInvalidated"/> from a peer still on the #96 topic is
-    /// applied too.
+    /// ScadaBridge#105: a PSK rotation written on one central node reaches the peer node's PSK
+    /// cache and its secret-resolver cache through the unified topic alone. Node A's invalidator
+    /// publishes; whatever node A puts on the mediator is delivered to node B's subscriber exactly
+    /// as <c>DistributedPubSub</c> would deliver it to a subscriber of that topic.
     /// </summary>
     [Fact]
-    public void Subscriber_AppliesALegacyBarePskInvalidation()
+    public void PskRotation_OnOneNode_ReachesThePeersCaches_ThroughTheUnifiedTopic()
+    {
+        // Node A: the node the secret is written on.
+        var mediatorA = CreateTestProbe();
+        _bus.SetMediator(mediatorA.Ref);
+        var invalidatorA = Create(_bus);
+
+        // Node B: the peer, with its own bus (own origin id) and its own caches.
+        var innerB = Substitute.For<ISecretCacheInvalidator>();
+        var pskB = Substitute.For<ISitePskProvider>();
+        var busB = new CentralCacheInvalidationBus(NullLogger<CentralCacheInvalidationBus>.Instance);
+        var invalidatorB = new SitePskRotationInvalidator(innerB, pskB, busB, NullLogger<SitePskRotationInvalidator>.Instance);
+        var subscriberB = Sys.ActorOf(Props.Create(() => new CentralCacheInvalidationSubscriber(
+            busB, new ICentralCacheInvalidationHandler[] { invalidatorB })));
+
+        invalidatorA.Invalidate(new SecretName("SB-GRPC-PSK-site-d"));
+
+        // Deliver every publish on the unified topic to B; nothing else is published.
+        var publish = mediatorA.ExpectMsg<Publish>();
+        Assert.Equal("central-cache-invalidation", publish.Topic);
+        subscriberB.Tell(publish.Message);
+        mediatorA.ExpectNoMsg(TimeSpan.FromMilliseconds(200));
+
+        AwaitAssert(() =>
+        {
+            pskB.Received(1).Invalidate("site-d");
+            innerB.Received(1).Invalidate(new SecretName("SB-GRPC-PSK-site-d"));
+        });
+    }
+
+    /// <summary>
+    /// ScadaBridge#105: the bare <see cref="SitePskInvalidated"/> that the removed #96 topic
+    /// carried is no longer handled — the subscriber only applies envelopes. The envelope row is
+    /// the positive control.
+    /// </summary>
+    [Fact]
+    public void Subscriber_IgnoresABarePskInvalidation_ButAppliesTheEnvelope()
     {
         var invalidator = Create(_bus);
         var subscriber = Sys.ActorOf(Props.Create(() => new CentralCacheInvalidationSubscriber(
             _bus, new ICentralCacheInvalidationHandler[] { invalidator })));
 
         subscriber.Tell(new SitePskInvalidated("site-c"));
+        subscriber.Tell(new CentralCacheInvalidationEnvelope("peer-node", new SitePskInvalidated("site-e")));
 
-        AwaitAssert(() => _psk.Received(1).Invalidate("site-c"));
+        AwaitAssert(() => _psk.Received(1).Invalidate("site-e"));
+        _psk.DidNotReceive().Invalidate("site-c");
     }
 }

tests/ZB.MOM.WW.ScadaBridge.IntegrationTests/Cluster/CentralCacheInvalidationTwoNodeTests.cs

@@ -76,12 +76,13 @@ public class CentralCacheInvalidationTwoNodeTests
         Assert.Contains(applied, i => i is RoleMappingsInvalidated);
         Assert.Contains(new ExternalDefinitionsInvalidated(), applied);
         Assert.Contains(new InboundApiMethodInvalidated("MesMoveIn"), applied);
-        // The PSK invalidation arrives twice during the migration window (shared + legacy topic).
-        Assert.Contains(new SitePskInvalidated("site-a"), applied);
-
-        // The publisher skips its own envelopes; only the bare legacy PSK message (no origin)
-        // comes back to it, which is the pre-existing #96 behaviour and idempotent.
+        // One topic only since ScadaBridge#105: the PSK invalidation arrives exactly once.
         await Task.Delay(500);
-        Assert.All(a.Handler.Applied, i => Assert.IsType<SitePskInvalidated>(i));
+        Assert.Single(b.Handler.Applied, i => i is SitePskInvalidated);
+        Assert.Contains(new SitePskInvalidated("site-a"), b.Handler.Applied);
+
+        // The publisher skips its own envelopes, and with the legacy bare PSK topic gone nothing
+        // comes back to it at all.
+        Assert.Empty(a.Handler.Applied);
     }
 }