feat(secrets): default resolver with TTL cache + audit (never logs plaintext)

ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Abstractions/ISecretActorAccessor.cs

@@ -0,0 +1,17 @@
+namespace ZB.MOM.WW.Secrets.Abstractions;
+
+/// <summary>
+/// Resolves the current principal (the ZB.MOM.WW.Auth identity) for audit attribution when a
+/// secret is resolved. A consumer wires this to whatever surfaces the ambient caller — an HTTP
+/// context accessor, an actor context, a CLI identity, etc. A <c>null</c> <see cref="CurrentActor"/>
+/// (or no accessor at all) is treated as the <c>"system"</c> actor by the resolver, so keyless /
+/// background resolutions are still attributed rather than left blank.
+/// </summary>
+public interface ISecretActorAccessor
+{
+    /// <summary>
+    /// The current principal to record as the audit <c>Actor</c>, or <c>null</c> when no
+    /// principal is available (treated as <c>"system"</c>).
+    /// </summary>
+    string? CurrentActor { get; }
+}