Marketplace: add MongoDB as an installable private database kind (git-app workers are unreachable by design) #195

Context

A member deployed a multi-app stack in a Space (web app + PostgreSQL + MongoDB) with the databases as git-apps in worker mode (exposed=false). The web app could not reach either database:

• Worker apps get no Kubernetes Service — the deployer actively deletes Service+Ingress for non-exposed apps, so <app>.<ns>.svc.cluster.local does not resolve and no <SVC>_SERVICE_HOST/_PORT env vars are injected.
• Even by pod IP they are unreachable: the Space-wide default-deny NetworkPolicy only admits ingress from Traefik (allow-traefik-ingress).

This is by design for git-app workers (zero inbound). The intended pattern for databases is the Marketplace, whose kinds ship their own Service + scoped per-app NetworkPolicy (see postgres-pgvector).

Problem

The marketplace catalog has no MongoDB kind (internal/marketplace/catalog.go): today only postgres-pgvector, qdrant, chromadb. There is no supported way to run MongoDB inside a Space.

Proposal

Add a mongodb marketplace kind, private-only (no public exposure in v1):

• Catalog entry: image mongo:8.0, defaults 500m/512Mi/5Gi, floor 100m/256Mi/1Gi, SupportsPublic: false, Protocol: tcp.
• Deployer mirroring the qdrant pattern (internal/marketplace/deployers/qdrant.go): StatefulSet + VolumeClaimTemplate (/data/db) + ClusterIP Service on 27017 + auth Secret (root user + generated password via generateHexToken), exec probes (mongosh --eval "db.adminCommand('ping')") since the port is not HTTP.
• Per-app NetworkPolicy scoped like the postgres one (postgres.go ensureNetworkPolicy): ingress TCP 27017 from same-namespace pods + ssh-gateway only. No NodePort/microVM/IPBlock in v1 (no public surface). The postgres netpol comment already anticipates Mongo as a future TCP kind with its own scoped From set.
• Standalone mongod (no replica set) in v1 — documented limitation: no multi-document transactions / change streams; revisit as a follow-up if members need them.
• ExposePublic=true on this kind must be rejected explicitly by the deployer, not silently coerced.
• Registration in cmd/server/main.go next to the qdrant/postgres deployers.
• Tests mirroring qdrant_test.go + the postgres netpol test (secret non-rotation on re-provision, PVC cleanup on destroy, netpol From-set and port assertions).

Acceptance criteria

• mongodb appears in GET /api/marketplace/catalog (UI renders kinds dynamically — no UI change needed)
• Private install provisions Secret + StatefulSet + Service + NetworkPolicy; ConnectionDetails returns <app>-mongo.<ns>.svc.cluster.local:27017 and a mongodb:// URL
• Destroy is idempotent and removes PVCs (quota freed)
• go build ./... and go test ./... green

Related

• Suspicion that private same-Space access to qdrant/chromadb is blocked by the same netpol posture: tracked separately (link in comments once filed).