fix(deps)!: pin patched SQLitePCLRaw in Secrets + Auth; publish Secrets 0.1.3, Auth 0.1.5

Packing Secrets 0.1.3 surfaced NU1903: Microsoft.Data.Sqlite 10.0.7 pulls
SQLitePCLRaw.lib.e_sqlite3 2.1.11, which carries high-severity advisory
GHSA-2m69-gcr7-jv3q. Auth.ApiKeys had the same exposure and was already shipped
at 0.1.4 to three consumers, so both libs are fixed rather than only the one
being published.

Fixed the way ZB.MOM.WW.LocalDb already had it: CentralPackageTransitivePinningEnabled
plus a pin to the patched 2.1.12. Bumping Microsoft.Data.Sqlite does not help --
even 10.0.10 still resolves 2.1.11 -- so the pin is the actual fix. The pin reaches
consumers: both nuspecs now declare SQLitePCLRaw.lib.e_sqlite3 >= 2.1.12 as a direct
dependency, verified by restoring the published packages into a scratch project,
which resolves 2.1.12 and scans clean.

Auth goes 0.1.4 -> 0.1.5 with no API change (0.1.4 plus the pin). Suites re-run
after the native-lib swap with identical counts, so no behavioral regression:
Secrets 97 pass/1 skip, Auth 215 pass/1 skip (both skips are Windows-only DPAPI
and opt-in LDAP).

Consumers are NOT yet bumped and remain on vulnerable versions: mxaccessgw 0.1.4,
HistorianGateway 0.1.4, ScadaBridge 0.1.3. Secrets consumers all sit at 0.1.2 and
also lack KEK rotation.

Claude-Session: https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts

components/secrets/GAPS.md

@@ -7,13 +7,20 @@ construction).
 
 ## Current state (verified 2026-07-18)
 
-- **Source is at `0.1.3`; the feed is at `0.1.2`.** `ZB.MOM.WW.Secrets/Directory.Build.props`
-  declares `<Version>0.1.3</Version>` and the G-8 KEK-rotation work (`KekRotationService`,
-  `RewrapReport`, `secret rewrap-all`, `docs/operations/kek-rotation.md`) is **committed and
-  pushed** on `main` (`d82d345`). The Gitea feed carries only `0.1.0`–`0.1.2` for all three
-  packages. **→ `0.1.3` is unpublished: no app can consume KEK rotation yet.** (An earlier note
-  claiming G-8 was "not yet committed/pushed" was stale — it is committed; only the *publish*
-  is outstanding.)
+- **`0.1.3` PUBLISHED to the Gitea feed 2026-07-18** (all three packages; restore-verified from a
+  scratch consumer). Carries the G-8 KEK-rotation work (`KekRotationService`, `RewrapReport`,
+  `secret rewrap-all`, `docs/operations/kek-rotation.md`), committed on `main` at `d82d345`.
+  (An earlier note claiming G-8 was "not yet committed/pushed" was stale.)
+- **`0.1.3` also carries a transitive security fix that `0.1.2` does not.** Packing surfaced
+  NU1903: `Microsoft.Data.Sqlite 10.0.7` pulls `SQLitePCLRaw.lib.e_sqlite3 2.1.11`, which has a
+  **high-severity** advisory (GHSA-2m69-gcr7-jv3q). Fixed the way `ZB.MOM.WW.LocalDb` already
+  did — `CentralPackageTransitivePinningEnabled` + a pin to the patched `2.1.12`. Bumping
+  `Microsoft.Data.Sqlite` does **not** help (even `10.0.10` still pulls `2.1.11`); the pin is the
+  fix. Verified: the shipped `.nuspec` declares `SQLitePCLRaw.lib.e_sqlite3 >= 2.1.12` as a direct
+  dependency, so **consumers get the patched native lib without needing their own pin**, and a
+  fresh consumer restoring `0.1.3` scans clean.
+- **All four apps are still pinned at `0.1.2`** — they get neither KEK rotation nor the security
+  fix until bumped.
 - **All four apps are pinned to `0.1.2`** — OtOpcUa, MxAccessGateway, ScadaBridge take
   `Secrets` + `.Abstractions` + `.Ui`; HistorianGateway takes `Secrets` + `.Ui`.
 - **G-7 clustered replication is designed + planned, not built** — plan at
@@ -23,7 +30,7 @@ construction).
 
 ### Open
 
-- ⬜ Publish `ZB.MOM.WW.Secrets` `0.1.3` (+ `.Abstractions`, `.Ui`) to the Gitea feed.
+- ⬜ Bump the four apps `0.1.2` → `0.1.3` to pick up KEK rotation + the SQLitePCLRaw security fix.
 - ⬜ Execute the G-7 plan (shared SQL-Server `ISecretStore`).
 - ⬜ Per-app live wonder gates for the G-8 rotation path.