feat(secrets): mount /admin/secrets + AddSecretsAuthorization in the dashboard (G-6)

src/ZB.MOM.WW.MxGateway.Server/GatewayApplication.cs

@@ -1,4 +1,5 @@
 using System.Security.Cryptography.X509Certificates;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Hosting.StaticWebAssets;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Logging.Configuration;
@@ -19,6 +20,7 @@ using ZB.MOM.WW.Secrets.Abstractions;
 using ZB.MOM.WW.Secrets.Configuration;
 using ZB.MOM.WW.Secrets.DependencyInjection;
 using ZB.MOM.WW.Secrets.Sqlite;
+using ZB.MOM.WW.Secrets.Ui;
 using ZB.MOM.WW.Telemetry;
 using ZB.MOM.WW.Telemetry.Serilog;
 
@@ -121,6 +123,10 @@ public static class GatewayApplication
         builder.Services.AddGatewaySessions();
         builder.Services.AddGatewayAlarms();
         builder.Services.AddGatewayDashboard(builder.Configuration);
+        // Register the shared Secrets UI authorization policies (secrets:manage + secrets:reveal)
+        // additively so they compose with the dashboard's existing AddAuthorization block. The
+        // mounted /admin/secrets Blazor page carries [Authorize(Policy = "secrets:manage")].
+        builder.Services.Configure<AuthorizationOptions>(o => o.AddSecretsAuthorization());
         // Register the gateway's browse-scope provider before AddZbGalaxyRepository so the
         // library's TryAddSingleton default (NullGalaxyBrowseScopeProvider) does not win.
         builder.Services.AddSingleton<ZB.MOM.WW.GalaxyRepository.Grpc.IGalaxyBrowseScopeProvider,