feat(secrets): pre-host ${secret:} config expansion in GatewayApplication.CreateBuilder (G-4 mechanism)

src/ZB.MOM.WW.MxGateway.Server/GatewayApplication.cs

@@ -15,6 +15,10 @@ using ZB.MOM.WW.MxGateway.Server.Security.Authentication;
 using ZB.MOM.WW.MxGateway.Server.Security.Authorization;
 using ZB.MOM.WW.MxGateway.Server.Sessions;
 using ZB.MOM.WW.MxGateway.Server.Workers;
+using ZB.MOM.WW.Secrets.Abstractions;
+using ZB.MOM.WW.Secrets.Configuration;
+using ZB.MOM.WW.Secrets.DependencyInjection;
+using ZB.MOM.WW.Secrets.Sqlite;
 using ZB.MOM.WW.Telemetry;
 using ZB.MOM.WW.Telemetry.Serilog;
 
@@ -64,6 +68,26 @@ public static class GatewayApplication
         });
         StaticWebAssetsLoader.UseStaticWebAssets(builder.Environment, builder.Configuration);
 
+        // Resolve ${secret:...} references in configuration BEFORE any config consumer (TLS, Kestrel,
+        // GatewayOptions/Ldap/Galaxy validators) reads a value, using a standalone secrets provider
+        // (envelope-decrypted via the master key). A token referencing a missing secret fails fast
+        // here (SecretNotFoundException); config with no tokens is untouched (no-op), so this is safe
+        // to always run. CreateBuilder is synchronous and single-shot at bootstrap, so the two awaits
+        // are driven via GetAwaiter().GetResult() (no sync-context deadlock risk during host startup).
+#pragma warning disable ASP0000 // deliberate throwaway container, disposed here, shares no singletons
+        using (var secretsProvider = new ServiceCollection()
+            .AddZbSecrets(builder.Configuration, "Secrets")
+            .BuildServiceProvider())
+#pragma warning restore ASP0000
+        {
+            secretsProvider.GetRequiredService<SqliteSecretsStoreMigrator>()
+                .MigrateAsync(default).GetAwaiter().GetResult();
+            var resolver = secretsProvider.GetRequiredService<ISecretResolver>();
+            new SecretReferenceExpander(resolver)
+                .ExpandConfigurationAsync((IConfigurationRoot)builder.Configuration, default)
+                .GetAwaiter().GetResult();
+        }
+
         ConfigureSelfSignedTls(builder);
 
         builder.AddZbSerilog(o => o.ServiceName = "mxgateway");