feat(secrets): AES-256-GCM envelope cipher with AAD binding

ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Abstractions/SecretsExceptions.cs

@@ -4,7 +4,17 @@ namespace ZB.MOM.WW.Secrets.Abstractions;
 public sealed class MasterKeyUnavailableException(string message) : InvalidOperationException(message);
 
 /// <summary>Thrown when a secret's ciphertext cannot be decrypted or its authentication tag fails to verify.</summary>
-public sealed class SecretDecryptionException(string message) : InvalidOperationException(message);
+public sealed class SecretDecryptionException : InvalidOperationException
+{
+    /// <summary>Creates the exception with a message describing the decryption failure.</summary>
+    /// <param name="message">The failure description.</param>
+    public SecretDecryptionException(string message) : base(message) { }
+
+    /// <summary>Creates the exception, preserving the underlying cryptographic fault.</summary>
+    /// <param name="message">The failure description.</param>
+    /// <param name="innerException">The original cryptographic exception that caused the failure.</param>
+    public SecretDecryptionException(string message, Exception innerException) : base(message, innerException) { }
+}
 
 /// <summary>Thrown when a requested secret does not exist (or is tombstoned) in the store.</summary>
 public sealed class SecretNotFoundException(string message) : InvalidOperationException(message);