feat(secrets): abstractions seam interfaces

ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Abstractions/IMasterKeyProvider.cs

@@ -0,0 +1,24 @@
+namespace ZB.MOM.WW.Secrets.Abstractions;
+
+/// <summary>
+/// Supplies the AES-256 master key (KEK) used to wrap and unwrap per-secret data-encryption
+/// keys. Implementations resolve the key material from a configured source (environment,
+/// file, external KMS) and expose a stable, non-secret identifier for the active key so
+/// rotation can be recorded per row and reasoned about later.
+/// </summary>
+public interface IMasterKeyProvider
+{
+    /// <summary>
+    /// Returns the 32-byte AES-256 master key material.
+    /// </summary>
+    /// <returns>The 32-byte master key.</returns>
+    /// <exception cref="MasterKeyUnavailableException">The master key cannot be resolved.</exception>
+    ReadOnlyMemory<byte> GetMasterKey();
+
+    /// <summary>
+    /// The stable, non-secret identifier of the active key-encryption key (KEK). This value
+    /// is recorded on each stored row so that key rotation is legible and rows can be matched
+    /// to the KEK that wrapped their DEK.
+    /// </summary>
+    string KekId { get; }
+}