feat(site): deployed_secrets (LocalDb-replicated ciphertext) + node-local mirrored_secrets ledger

tests/ZB.MOM.WW.ScadaBridge.Host.Tests/SiteLocalDbCdcRegistrationTests.cs

@@ -104,6 +104,21 @@ public class SiteLocalDbCdcRegistrationTests : IDisposable
         Assert.DoesNotContain(triggers, t => t.StartsWith("__localdb_smtp_configurations_", StringComparison.Ordinal));
     }
 
+    [Fact]
+    public void ReplicatedNode_InstallsNoCaptureTriggersOnTheNodeLocalMirroredSecretsLedger()
+    {
+        // mirrored_secrets records which names THIS node has mirrored into its own secret
+        // store — per-node fact, not site-wide state. Capturing it would replicate one node's
+        // mirroring progress onto the other, so it must stay uncaptured even on a fully
+        // replicated node.
+        var db = BuildDatabase(Config(apiKey: "cdc-test-key"));
+
+        var triggers = CaptureTriggers(db);
+
+        Assert.DoesNotContain(triggers, t => t.StartsWith("__localdb_mirrored_secrets_", StringComparison.Ordinal));
+        Assert.DoesNotContain("mirrored_secrets", db.ReplicatedTables.Keys);
+    }
+
     [Fact]
     public void UnreplicatedNode_DropsTriggersLeftByAPreviouslyReplicatedBuild()
     {
@@ -196,13 +211,18 @@ public class SiteLocalDbCdcRegistrationTests : IDisposable
 
     // ---- helpers ----------------------------------------------------------------------
 
-    /// <summary>The ten replicated tables plus the two deliberately-unregistered ones.</summary>
+    /// <summary>
+    /// The eleven replicated tables, plus the two deliberately-unregistered central-only
+    /// notification tables, plus the node-local (also deliberately-unregistered)
+    /// <c>mirrored_secrets</c> ledger.
+    /// </summary>
     private static readonly string[] AllSiteTables =
     [
         "OperationTracking", "site_events", "sf_messages", "deployed_configurations",
         "static_attribute_overrides", "shared_scripts", "external_systems",
         "database_connections", "data_connection_definitions", "native_alarm_state",
-        "notification_lists", "smtp_configurations",
+        "deployed_secrets",
+        "notification_lists", "smtp_configurations", "mirrored_secrets",
     ];
 
     private static readonly string[] ReplicatedTables =
@@ -210,6 +230,7 @@ public class SiteLocalDbCdcRegistrationTests : IDisposable
         "OperationTracking", "site_events", "sf_messages", "deployed_configurations",
         "static_attribute_overrides", "shared_scripts", "external_systems",
         "database_connections", "data_connection_definitions", "native_alarm_state",
+        "deployed_secrets",
     ];
 
     private static void AssertCaptureTriggersCoverTheReplicatedTables(ILocalDb db)