feat(drivers/mongodb): add MongoDB driver, docs, packaging, and tests

[SakuraIsayeki]

Add a bundled MongoDB driver that discovers authorized databases and produces filtered per-database mongodump archives or directory dumps. Include the driver executable (prepare/connectivity/health verbs), driver reference, restore runbook, example instance and secret files, and README/guide updates.

Add the explicitly selected backmaster-driver-mongodb Debian component, requiring mongodb-mongosh and mongodb-database-tools >= 100.3.0. The compatibility backmaster metapackage continues to install core, PostgreSQL, and rclone; MongoDB is optional.

Review fixes:

• Keep login passwords, PEM passwords, and the URI out of process arguments. Discovery reads the environment inside static mongosh code; dumps use temporary mode-0600 config files with exit/signal cleanup.
• Use Database Tools' SSL flags and mongosh's TLS URI options instead of a shared incompatible argument array.
• Put MongoDB driver/exporter secrets in /etc/backmaster/mongodb-secrets with root:backmaster ownership; preserve existing PostgreSQL permissions.
• Extract archives into a newly created empty directory before checking inner checksums.
• Document separate original-namespace users/roles restores, including the admin exception; fix uncompressed restore instructions.
• Verify MongoDB upgrades as backmaster against the MongoDB instance.
• Integrate current main, including the packaging and AzCopy fixes.

Validation:

• Local ShellCheck, Bash syntax checks, all existing test suites, expanded MongoDB credential/TLS/cleanup regressions, and Debian package checks pass.
• CI is green at 5f1280243910caca3cefca001983bc29dfb70901: both shell and mongodb-integration pass. Verified CI run.
• Real-tool integration with MongoDB 8.0.12, mongosh 2.5.10, and Database Tools 100.15.0 verifies authentication, encrypted client PEMs, TLS hostname rejection and the explicit insecure override, uncompressed archive/directory dumps with user/role restores, and gzip namespace-remapped restores.
• All eight original Copilot review threads have been addressed. MongoDB remains an optional component; the metapackage discrepancy was corrected in this description.

No changes to production hosts or credentials.

[Copilot]

Pull request overview

Adds a bundled MongoDB backup driver with packaging, configuration examples, restore guidance, and automated tests.

Changes:

• Implements filtered per-database archive and directory dumps.
• Adds Debian packaging and CI coverage.
• Documents installation, operation, security, and restoration.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
.github/workflows/ci.yml	Runs MongoDB driver tests.
.github/workflows/deb.yml	Validates the additional package.
README.md	Introduces MongoDB support.
config/drivers/mongodb.env.example	Provides driver configuration.
config/drivers/mongodb.secrets.env.example	Provides credential examples.
config/instances/nsys-mongodb.env.example	Defines an example instance.
docs/drivers/index.md	Lists the MongoDB driver.
docs/drivers/mongodb.md	Documents driver behavior and setup.
docs/guides/configuration.md	Covers MongoDB configuration.
docs/guides/index.md	Links the restore guide.
docs/guides/installation.md	Adds MongoDB installation steps.
docs/guides/mongodb-restore.md	Adds the restore runbook.
docs/guides/operations.md	Adds verification and MongoDB operations.
docs/guides/secrets.md	Documents MongoDB credentials.
docs/guides/systemd.md	Covers MongoDB service ordering.
docs/guides/troubleshooting.md	Adds MongoDB diagnostics.
drivers/mongodb/driver	Implements discovery and dumps.
packaging/build-deb.sh	Builds the MongoDB driver package.
tests/debian-packages.bash	Tests package metadata and contents.
tests/mongodb-driver.bash	Tests driver filtering and output.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.