feat: store layer with indexes, optimistic concurrency, GridFS, credential crypto (phase 2)

- mongo-driver v2 connection with bounded startup retry + /readyz gate
- idempotent creation of all §4.9 indexes
- UpdateVersioned: version-filtered updates, conflict vs not-found errors
- AES-256-GCM Seal/Open for ticketing credentials, base64(nonce|ct)
- GridFS file store: MIME sniffing, MAX_UPLOAD_MB cap, sha256 metadata
- HMAC-signed short-lived file URL tokens (§5.1, 1h TTL)
- integration tests against compose Mongo via docker-compose.test.yml overlay

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

DECISIONS.md

@@ -36,3 +36,24 @@ Spec-silent choices, recorded as required by the build instructions.
   is not an error (containers receive env via compose `env_file`).
 - **Makefile `seed`/`backup`/`restore` are failing stubs until Phase 12** so
   the targets exist but cannot be mistaken for working.
+
+## Phase 2
+
+- **Integration tests reach Mongo via `docker-compose.test.yml`**, an explicit
+  test-only overlay publishing Mongo on `127.0.0.1:27017`. The normal compose
+  file still never publishes Mongo (§12); the spec's integration-test
+  requirement (§2.1) needs host access, and a loopback-only opt-in overlay is
+  the smallest hole. Each run uses a `bountyboard_test_<ulid>` database and
+  drops it on cleanup.
+- **`UpdateVersioned` rejects updates that touch `version`** and merges
+  `updatedAt`/`$inc version` into the caller's operators; it distinguishes
+  `ErrNotFound` from `ErrVersionConflict` with a follow-up existence check.
+- **File MIME type = sniffed (`http.DetectContentType`) unless inconclusive**
+  (`application/octet-stream`), in which case the client-declared type is
+  kept. A confident sniff overrides a lying declaration.
+- **sha256 of uploads is recorded post-upload** via an update on `fs.files`
+  metadata (GridFS metadata must be supplied before streaming; the hash is
+  only known after).
+- **Signed file tokens** are `base64url(exp || hmac-sha256(fileID|exp))` with
+  a key derived as `sha256("bountyboard/file-url/v1" + SESSION_SECRET)` so
+  file tokens can never collide with other uses of the session secret.