docs(secrets): lmxopcua#483 fixed - /admin/secrets interactive via host wrapper page

Claude-Session: https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts

components/secrets/GAPS.md

@@ -156,9 +156,14 @@ project 38/38 green.
   repeated restarts; a secret seeded into site-a-1's store alone converged to all five peers within
   ≤60 s with **byte-identical ciphertext on all six nodes** (same sha256/kek_id), decrypt-verified on
   central-2 + site-b-2; site-b-2 restart rejoined with the row intact. Found during verification and
-  filed as [`lmxopcua#483`](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/483): the AdminUI
-  `/admin/secrets` page is non-interactive (Secrets.Ui RCL has no `@rendermode`; hosts applying render
-  modes per-page get a dead page — check the other three apps for the same pattern).
+  filed as [`lmxopcua#483`](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/483)
+  (**FIXED + CLOSED 2026-07-19**, `lmxopcua master @ 5f72ff85`): OtOpcUa's `/admin/secrets` was
+  non-interactive because its static per-page-rendermode router routed straight to the RCL page,
+  which cannot carry `@rendermode` itself (the other three apps render it under globally interactive
+  routers where a nested render mode throws — verified, so no RCL change). Fix = host-side wrapper
+  page owning the route with `@rendermode InteractiveServer` + policy/route-parity pin tests
+  (`SecretsPageWiringTests`); Playwright-verified live on the rig (circuit + working Add-secret).
+  The wrapper is the reference pattern for any static-router consumer of Secrets.Ui.
   **Production/wonder enablement is deliberately NOT done** — needs its own decision + real KEK
   distribution (never the committed dev key) per the clustered-secrets runbook.
 - ✅ ScadaBridge's hub topology **is** live-validated and safe to enable (config + a shared KEK).