feat: add optional MongoDB replica deployment (#765)

scripts/mongodb-replica-entrypoint.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+source_keyfile="${MONGO_REPLICA_KEYFILE_PATH:-/run/secrets/mongo-replica-keyfile}"
+runtime_keyfile="/tmp/mongo-replica-keyfile"
+
+if [[ ! -s "$source_keyfile" ]]; then
+  echo "MongoDB replica keyfile is missing or empty: $source_keyfile" >&2
+  exit 1
+fi
+
+# Bind-mounted secrets commonly have host ownership or permissive modes that
+# mongod rejects. Copy to an ephemeral location with the required ownership
+# and permissions before the official image entrypoint drops privileges.
+install -m 400 -o mongodb -g mongodb "$source_keyfile" "$runtime_keyfile"
+
+exec /usr/local/bin/docker-entrypoint.sh "$@"