fix(secrets): bridge the shared audit seam so /admin/secrets renders (#22)

Secrets.Ui components inject the SHARED ZB.MOM.WW.Audit.IAuditWriter seam,
which is deliberately distinct from the repo's own Commons IAuditWriter —
the G-4 adoption mounted the UI without registering it, so component
activation threw and the page 500'd on every render (hidden behind the
login wall; it plausibly never worked).

Fix: CentralSharedSeamAuditWriter forwards the shared seam into the central
direct-write path (ICentralAuditWriter -> dbo.AuditLog) — NOT the site
SQLite chain, which is never resolved on central and has no forwarder
there. Registered in the Central composition root next to the Secrets UI
authorization wiring.

Regression pin: CentralCompositionRootTests resolves the full Secrets.Ui
component injection set (ISecretStore / ISecretCipher / shared
IAuditWriter) out of the REAL Program.cs via WebApplicationFactory, plus a
type check that the seam is the central bridge. Red on the previous
commit; the defect class is invisible until the DI graph is actually
built.

Live-proven on the local docker cluster: /admin/secrets 200 + interactive
(Blazor circuit + working @onclick), and secret.add / secret.delete events
(both outcomes) landed in central dbo.AuditLog via the bridge.

Closes #22

Claude-Session: https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts

src/ZB.MOM.WW.ScadaBridge.Host/Program.cs

@@ -192,6 +192,14 @@ try
         // builds identities with RoleClaimType = ZbClaimTypes.Role, so an Administrator is
         // authorized for both manage + reveal. Done Host-side to keep Secrets.Ui out of Security.
         builder.Services.Configure<AuthorizationOptions>(o => o.AddSecretsAuthorization());
+        // Secrets.Ui components audit through the SHARED ZB.MOM.WW.Audit.IAuditWriter seam,
+        // which is deliberately distinct from the repo's own Commons IAuditWriter — bridge it
+        // to the central direct-write path (ICentralAuditWriter → dbo.AuditLog), NOT the site
+        // SQLite chain, which is never resolved on central and has no forwarder here
+        // (ScadaBridge#22; component activation 500'd without this registration).
+        builder.Services.AddSingleton<ZB.MOM.WW.Audit.IAuditWriter>(
+            sp => new ZB.MOM.WW.ScadaBridge.Host.Services.CentralSharedSeamAuditWriter(
+                sp.GetRequiredService<ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Services.ICentralAuditWriter>()));
         builder.Services.AddInboundAPI();
 
         // Inbound-API auth re-arch: the shared ZB.MOM.WW.Auth.ApiKeys verifier +

src/ZB.MOM.WW.ScadaBridge.Host/Services/CentralSharedSeamAuditWriter.cs

@@ -0,0 +1,30 @@
+using ZB.MOM.WW.Audit;
+using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Services;
+
+namespace ZB.MOM.WW.ScadaBridge.Host.Services;
+
+/// <summary>
+/// Central-only bridge from the shared-library audit seam
+/// (<see cref="ZB.MOM.WW.Audit.IAuditWriter"/>) to the central direct-write path
+/// (<see cref="ICentralAuditWriter"/> → dbo.AuditLog). Shared-lib UI components —
+/// today the Secrets.Ui components mounted at /admin/secrets — inject the shared
+/// seam, which is deliberately distinct from the repo's own
+/// <see cref="Commons.Interfaces.Services.IAuditWriter"/> (ScadaBridge#22).
+/// </summary>
+/// <remarks>
+/// The target is <see cref="ICentralAuditWriter"/> and NOT the repo's own site
+/// writer chain: the site SQLite chain is registered on central but by design
+/// never resolved there, and events written to it would dead-end in a local file
+/// that no forwarding sidecar drains on a central node. The best-effort contract
+/// (audit failures never abort the user-facing action) is inherited from
+/// <see cref="AuditLog.Central.CentralAuditWriter"/>, which swallows and logs —
+/// so this forward needs no try/catch of its own.
+/// </remarks>
+/// <param name="central">The central direct-write audit path to forward into.</param>
+public sealed class CentralSharedSeamAuditWriter(ICentralAuditWriter central)
+    : ZB.MOM.WW.Audit.IAuditWriter
+{
+    /// <inheritdoc />
+    public Task WriteAsync(AuditEvent auditEvent, CancellationToken cancellationToken = default)
+        => central.WriteAsync(auditEvent, cancellationToken);
+}

tests/ZB.MOM.WW.ScadaBridge.Host.Tests/CompositionRootTests.cs

@@ -18,6 +18,7 @@ using ZB.MOM.WW.ScadaBridge.HealthMonitoring;
 using ZB.MOM.WW.ScadaBridge.Host;
 using ZB.MOM.WW.ScadaBridge.Host.Actors;
 using ZB.MOM.WW.ScadaBridge.Host.Health;
+using ZB.MOM.WW.ScadaBridge.Host.Services;
 using ZB.MOM.WW.ScadaBridge.InboundAPI;
 using ZB.MOM.WW.ScadaBridge.ManagementService;
 using ZB.MOM.WW.ScadaBridge.NotificationService;
@@ -333,6 +334,43 @@ public class CentralCompositionRootTests : IDisposable
         Assert.NotNull(gate);
         Assert.IsType<ActiveNodeGate>(gate);
     }
+
+    // --- ScadaBridge#22 regression ---
+
+    /// <summary>
+    /// ScadaBridge#22 regression: the Secrets.Ui components mounted at /admin/secrets inject
+    /// <see cref="ZB.MOM.WW.Audit.IAuditWriter"/> — the SHARED-lib seam, not the repo's own
+    /// <see cref="IAuditWriter"/> (deliberately distinct per its doc comment). The secrets
+    /// adoption mounted the UI without bridging that seam, so component activation threw and
+    /// the page 500'd on every render; the login wall hid it. This resolves the full
+    /// injection set of every Secrets.Ui component (SecretsList / SecretEditor /
+    /// RevealButton / ConfirmDeleteModal) out of the REAL central composition root, because
+    /// the gap is invisible until the graph is actually built — the same defect class as the
+    /// four caught in the secrets library itself.
+    /// </summary>
+    [Theory]
+    [InlineData(typeof(ZB.MOM.WW.Secrets.Abstractions.ISecretStore))]
+    [InlineData(typeof(ZB.MOM.WW.Secrets.Abstractions.ISecretCipher))]
+    [InlineData(typeof(ZB.MOM.WW.Audit.IAuditWriter))]
+    public void Central_Resolves_SecretsUiComponentDependencies(Type serviceType)
+    {
+        var service = _factory.Services.GetService(serviceType);
+        Assert.NotNull(service);
+    }
+
+    /// <summary>
+    /// The bridge must route secrets-UI audit events into the CENTRAL direct-write path
+    /// (<see cref="ICentralAuditWriter"/> → dbo.AuditLog), not the site SQLite chain — the
+    /// site writer chain is registered on central but by design never resolved there, and
+    /// events written to it would dead-end in a local file no forwarder ever drains.
+    /// </summary>
+    [Fact]
+    public void Central_SharedAuditSeam_IsTheCentralDirectWriteBridge()
+    {
+        var writer = _factory.Services.GetService<ZB.MOM.WW.Audit.IAuditWriter>();
+        Assert.NotNull(writer);
+        Assert.IsType<CentralSharedSeamAuditWriter>(writer);
+    }
 }
 
 /// <summary>