chore(secrets): adopt ZB.MOM.WW.Secrets 0.6.2 and close the pre-host guard gap

0.6.x refuses a secret store whose path is relative or inside the content root,
because a store in the deployment directory is destroyed by an ordinary upgrade —
the failure that wiped the MxGateway API-key store on 2026-08-09 and read as an
auth outage rather than a deployment error.

The pin alone would not have protected this repo. Program.cs expands ${secret:}
before the host exists, composing secrets into a throwaway ServiceCollection with
no IHostEnvironment, so the guard would not run at the moment the migrator creates
the store. That composition now lives in SecretsRegistration with an explicit
content root — resolved to match what the host resolves later, including the
Windows-Service case where the pre-host CWD is still system32 — and is covered by
PreHostSecretsContentRootTests, verified by simulating the regression and
confirming it fails on the leftover file rather than on the exception.

The docker rig needed a fix too: /app/data is absolute but inside the container's
content root, so all 8 nodes would have failed to boot. Each node's data directory
is now mounted a second time at /data; same host directory, so existing stores
carry over untouched.

Verified: build clean, 29 test assemblies green (Playwright's 159 failures are the
pre-existing SEC-36 login baseline). Not yet deployed — the rig runs the old
config until someone redeploys.

src/ZB.MOM.WW.ScadaBridge.Host/Program.cs

@@ -101,6 +101,12 @@ var expanderUsesSharedSqlStore =
         configuration["ScadaBridge:Node:Role"], "Central", StringComparison.OrdinalIgnoreCase)
     && SecretsRegistration.UsesGrpcHub(configuration);
 
+// Secrets 0.6.2 validates Secrets:SqlitePath as absolute AND outside the content root, finding the
+// content root from IHostEnvironment — which this throwaway ServiceCollection does not have, and
+// which does not exist yet anyway (the host is not built until further down). Both the resolution
+// and the registration therefore live in SecretsRegistration, where a test can enforce them; see
+// AddPreHostSqliteExpander for why the content-root argument is load-bearing and silent when
+// dropped, and PreHostSecretsContentRootTests for the regression guard.
 var expanderServices = new ServiceCollection();
 if (expanderUsesSharedSqlStore)
 {
@@ -109,7 +115,8 @@ if (expanderUsesSharedSqlStore)
 }
 else
 {
-    expanderServices.AddZbSecrets(configuration, "Secrets");
+    expanderServices.AddPreHostSqliteExpander(
+        configuration, SecretsRegistration.ResolveHostContentRoot());
 }
 
 #pragma warning disable ASP0000 // deliberate throwaway container