feat: store layer with indexes, optimistic concurrency, GridFS, credential crypto (phase 2)

- mongo-driver v2 connection with bounded startup retry + /readyz gate
- idempotent creation of all §4.9 indexes
- UpdateVersioned: version-filtered updates, conflict vs not-found errors
- AES-256-GCM Seal/Open for ticketing credentials, base64(nonce|ct)
- GridFS file store: MIME sniffing, MAX_UPLOAD_MB cap, sha256 metadata
- HMAC-signed short-lived file URL tokens (§5.1, 1h TTL)
- integration tests against compose Mongo via docker-compose.test.yml overlay

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

cmd/app/main.go

@@ -8,10 +8,12 @@ import (
 	"os"
 	"os/signal"
 	"syscall"
+	"time"
 
 	"bountyboard/internal/config"
 	httpx "bountyboard/internal/http"
 	"bountyboard/internal/metrics"
+	"bountyboard/internal/store"
 )
 
 func main() {
@@ -33,10 +35,28 @@ func run() error {
 	log := slog.New(slog.NewJSONHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelInfo}))
 	slog.SetDefault(log)
 
-	reg := metrics.NewRegistry()
-	srv := httpx.New(cfg, log, reg)
-
 	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
 	defer stop()
+
+	st, err := store.Connect(ctx, cfg, log)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		closeCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		if err := st.Close(closeCtx); err != nil {
+			log.Error("close mongo", "err", err)
+		}
+	}()
+
+	reg := metrics.NewRegistry()
+	srv := httpx.New(cfg, log, reg)
+	srv.AddReadinessCheck(httpx.ReadinessCheck{
+		Name:     "mongo",
+		Required: true,
+		Probe:    st.Ping,
+	})
+
 	return srv.Run(ctx)
 }