feat(artifacts): additive Secrets list + SecretsApplied on the artifact deploy contract (proto field 9)

src/ZB.MOM.WW.ScadaBridge.Commons/Messages/Artifacts/ArtifactDeploymentResponse.cs

@@ -5,4 +5,5 @@ public record ArtifactDeploymentResponse(
     string SiteId,
     bool Success,
     string? ErrorMessage,
-    DateTimeOffset Timestamp);
+    DateTimeOffset Timestamp,
+    int? SecretsApplied = null);

src/ZB.MOM.WW.ScadaBridge.Commons/Messages/Artifacts/DeployArtifactsCommand.cs

@@ -8,4 +8,5 @@ public record DeployArtifactsCommand(
     IReadOnlyList<NotificationListArtifact>? NotificationLists,
     IReadOnlyList<DataConnectionArtifact>? DataConnections,
     IReadOnlyList<SmtpConfigurationArtifact>? SmtpConfigurations,
-    DateTimeOffset Timestamp);
+    DateTimeOffset Timestamp,
+    IReadOnlyList<SecretArtifact>? Secrets = null);

src/ZB.MOM.WW.ScadaBridge.Commons/Messages/Artifacts/SecretArtifact.cs

@@ -0,0 +1,21 @@
+namespace ZB.MOM.WW.ScadaBridge.Commons.Messages.Artifacts;
+
+/// <summary>
+/// One secret shipped to a site with its artifacts: the ZB.MOM.WW.Secrets StoredSecret row
+/// VERBATIM — ciphertext under the fleet's shared KEK, never plaintext. The site applies it
+/// with ISecretStore.ApplyReplicatedAsync. Design: docs/plans/2026-09-28-site-secrets-artifact-deploy-design.md §3.3.
+/// </summary>
+public sealed record SecretArtifact(
+    string Name,
+    string ContentType,
+    byte[] Ciphertext,
+    byte[] Nonce,
+    byte[] Tag,
+    byte[] WrappedDek,
+    byte[] WrapNonce,
+    byte[] WrapTag,
+    string KekId,
+    long Revision,
+    DateTimeOffset CreatedUtc,
+    DateTimeOffset UpdatedUtc,
+    string? Description = null);