fix(secrets): honor env-supplied LDAP bind password in live LDAP integration suite; clarify pre-host migration

src/ZB.MOM.WW.MxGateway.IntegrationTests/DashboardLdapLiveTests.cs

@@ -161,12 +161,32 @@ public sealed class DashboardLdapLiveTests
 
         IConfiguration configuration = new ConfigurationBuilder()
             .AddJsonFile(appSettingsPath, optional: false)
+            .AddEnvironmentVariables()
             .Build();
 
         // Same section production binds in AddZbLdapAuth(configuration, "MxGateway:Ldap").
         // Get<T> returns null only when the section is absent; appsettings.json always
         // carries it, so fall back to shared defaults defensively rather than throw.
-        return configuration.GetSection("MxGateway:Ldap").Get<LibraryLdapOptions>()
+        LibraryLdapOptions options = configuration.GetSection("MxGateway:Ldap").Get<LibraryLdapOptions>()
             ?? new LibraryLdapOptions();
+
+        // appsettings.json now ships the bind password as the unexpanded
+        // "${secret:ldap/mxgateway/bind}" token (resolved at gateway startup by the
+        // pre-host secrets expander, which this bare ConfigurationBuilder does not run).
+        // AddEnvironmentVariables() above lets MxGateway__Ldap__ServiceAccountPassword
+        // override the token with the real password. Fail loud rather than silently
+        // binding with the literal token string, which would make every live test in
+        // this file fail with a confusing LDAP bind error instead of an actionable one.
+        if (string.IsNullOrEmpty(options.ServiceAccountPassword)
+            || options.ServiceAccountPassword.StartsWith("${secret:", StringComparison.Ordinal))
+        {
+            throw new InvalidOperationException(
+                "Live LDAP tests require the real bind password via the "
+                + "MxGateway__Ldap__ServiceAccountPassword environment variable "
+                + "(appsettings now ships a ${secret:} token that this suite does not expand). "
+                + "Set it before running.");
+        }
+
+        return options;
     }
 }

src/ZB.MOM.WW.MxGateway.Server/GatewayApplication.cs

@@ -82,6 +82,9 @@ public static class GatewayApplication
             .BuildServiceProvider())
 #pragma warning restore ASP0000
         {
+            // Intentionally unconditional: the pre-host expander below needs the secrets
+            // store schema to exist before the first ${secret:} resolve. Secrets:RunMigrationsOnStartup
+            // governs only the runtime SecretsMigrationHostedService, not this bootstrap path.
             secretsProvider.GetRequiredService<SqliteSecretsStoreMigrator>()
                 .MigrateAsync(default).GetAwaiter().GetResult();
             var resolver = secretsProvider.GetRequiredService<ISecretResolver>();