test(centralui): pin the Administrator-only /admin/secrets nav link

The Secrets management UI (ZB.MOM.WW.Secrets Secrets.Ui, mounted at
/admin/secrets) has been linked from the NavMenu Admin section since the
Theme adoption, but no NavMenu test asserted it. Add bUnit coverage that
the item renders for an Administrator and is absent for a
Designer+Deployer principal, matching the existing role-gate test style.

tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/Layout/NavMenuTests.cs

@@ -150,6 +150,30 @@ public class NavMenuTests : BunitContext
         });
     }
 
+    [Fact]
+    public void AdminSection_SecretsLink_VisibleForAdministrator()
+    {
+        var cut = RenderWithRoles("Administrator");
+
+        cut.WaitForAssertion(() =>
+        {
+            // Secrets management UI (ZB.MOM.WW.Secrets Secrets.Ui) — Administrator only.
+            Assert.Contains("/admin/secrets", cut.Markup);
+        });
+    }
+
+    [Fact]
+    public void AdminSection_SecretsLink_AbsentForNonAdministrator()
+    {
+        // Designer + Deployer covers every non-admin section without RequireAdmin.
+        var cut = RenderWithRoles("Designer", "Deployer");
+
+        cut.WaitForAssertion(() =>
+        {
+            Assert.DoesNotContain("/admin/secrets", cut.Markup);
+        });
+    }
+
     // ── AuthorizeView-gated SECTION visibility (the GAPS open question) ──────
     // A whole NavRailSection wrapped in <AuthorizeView Policy="..."> must SHOW
     // (heading + items) for an authorized principal and be entirely ABSENT for