Hand MongoDB over to the estate path once mongo-backup is released #748

Parent

Hand over data to the estate path, the W5 follow-up on JorisJonkers-dev/estate#216.

What this is

Data's handover goes ahead without MongoDB (decided 2026-10-30): Overleaf's MongoDB stays on the old path, in fleet-infra's apps-data-leftovers, and follows on its own once a mongo-backup image exists. The image now exists in code (JorisJonkers-dev/delivery#109, merged). This ticket is the rest.

What it needs

1. A delivery release carrying mongo-backup, and the estate's Platform images lock pinning it (by pull request in JorisJonkers-dev/estate, as for the other backup images).
2. A login, or a decision not to have one. The live MongoDB runs without authentication, deliberately: fleet-infra's cluster/flux/apps/data/mongo/statefulset.yaml says auth on a replica set needs a shared keyFile, which the official image cannot combine with MONGO_INITDB_ROOT_*. mongo-backup logs in as MONGO_USERNAME with MONGO_PASSWORD, a user of admin, and refuses to run without them. So one of:
   • turn auth on (a keyFile Secret, a user made after rs.initiate, a rolling restart; Overleaf's connection string gains the login), which that file names as the change to make once a second client appears. The backup is that client. Or:
   • let the method dump unauthenticated when its credential holds no login, a change in delivery.
3. The backup credential at secret/data/data/mongo/backup (MONGO_USERNAME, MONGO_PASSWORD), added to bootstrap/secrets.sh --only data (feat(bootstrap): copy the data Project's catalog and backup logins estate#267) once the login exists.
4. The declaration in the estate's platform/data/data.project.yml: the mongo engine, its irreplaceable or recoverable claim adopted as mongo-data-mongo-0, and the Platform document's engines.mongo entry.
5. The replica set's member host. It is mongo-0.mongo.data-system.svc.cluster.local, a StatefulSet ordinal name the render does not make. The member must be reconfigured (rs.reconfig) to the rendered Service's name in the window, or the render must give a stable per-pod name.
6. --oplog: the dump is taken without it. On a one-member replica set it would give a point-in-time dump; on a standalone it fails. Decide whether the method adds it.
7. The fleet-infra change that moves mongo out of apps-data-leftovers, with the PV Retain check for mongo-data-mongo-0.

Acceptance criteria

• MongoDB is delivered by the estate path, its claim adopted in place, and Overleaf reconnects.
• Its derived backup's first run writes a generation that mongorestore reads back.
• Nothing of MongoDB is left in apps-data-leftovers.