SiteSettingsSecrets

Platform secrets pulled explicitly (api-admin only) by server-side consumers (Publisher, SignTool). These fields are [JsonIgnore]d on SiteSettings so they never reach a generic reader; this dedicated DTO is the only path that returns them, behind an explicit access check, and that stores them.

Erbt von: BaseEntity