Deployment: pin MongoDB, add DB auth, probes #68

Why?

Besides config handling (#67), the Helm chart and Compose setup have several deployment issues:

• MongoDB version: the chart uses mongo:noble, which currently resolves to MongoDB 8.x. MongoDB 8.0 refuses to start on Linux kernels 6.19 to 7.0.13 (SERVER-121912), which affects some current nodes and GitHub runners. The tag is also unpinned, so a redeploy can silently jump to a new major version and its data format. docker-compose.yaml uses mongo:3.6 on dev (end of life).
• MongoDB without authentication: the chart creates no Secret and starts MongoDB without credentials. FOCA ≥ 0.14 reads MONGO_URI (or MONGO_USERNAME / MONGO_PASSWORD) from the environment, but nothing sets them.
• No probes: the app Deployment has no readiness or liveness probes, so traffic is routed to pods before they can serve, and hung pods are not restarted.
• MongoDB rollout strategy: templates/mongo-deploy.yaml uses strategy: RollingUpdate (25% surge), but MongoDB's data volume is a ReadWriteOnce PVC (templates/mongo-pvc.yaml). On every rollout (e.g. an image change), the new pod starts while the old one still holds the volume: on another node it hangs on Multi-Attach error, on the same node two mongod processes compete for the same data directory.
• Init script: templates/mongo-init-script.yaml creates the services and service_info collections with their indexes, duplicating the db section of config.yaml. FOCA already creates configured collections and indexes on startup. Once access control lands (Cloud Registry backend: public read access, service ownership, ECP_CLN:ADMIN admin role #62), the policy_rules collection would be missing from the script.
• Small leftovers: the config Job's container is named certbot and the script logs "WES APP NAME" (copied from other charts); README.md refers to deployments/ instead of deployment/.

How?

1. Pin MongoDB to a major version that runs on current kernels (e.g. mongo:7.0) in both the chart (mongodb.image) and docker-compose.yaml, and document how to upgrade an existing data directory (upgrade one major version at a time, set featureCompatibilityVersion in between).
2. Add optional MongoDB authentication:
   • values mongodb.auth.enabled and mongodb.existingSecret (no credentials in values files);
   • the MongoDB Deployment gets MONGO_INITDB_ROOT_USERNAME / MONGO_INITDB_ROOT_PASSWORD from the Secret;
   • the app gets MONGO_URI (or username and password) from the same Secret via secretKeyRef.
3. Add readiness and liveness probes to the app container (e.g. HTTP GET /ga4gh/registry/v1/service-info), and a readiness probe to MongoDB.
4. Set strategy: type: Recreate on the MongoDB Deployment, so the old pod releases the volume before the new one starts.
5. Check whether the init script is still needed now that FOCA creates collections and indexes on startup; remove it if not, otherwise keep it in sync (policy_rules).
6. Fix the leftovers listed above.

Acceptance criteria

• MongoDB image pinned to a supported major version in chart and Compose; upgrade notes in the deployment docs.
• With auth enabled and a Secret provided, MongoDB requires credentials and the app connects with them; no credentials appear in ConfigMaps or values.
• App and MongoDB have probes; kubectl rollout status waits for a ready app.
• Changing the MongoDB image rolls out without a Multi-Attach error or a second mongod on the same volume.
• The init script is removed or matches the configured collections.