Add unit tests and implementations for MongoDB index models and OpenAPI metadata

- Implemented `MongoIndexModelTests` to verify index models for various stores.
- Created `OpenApiMetadataFactory` with methods to generate OpenAPI metadata.
- Added tests for `OpenApiMetadataFactory` to ensure expected defaults and URL overrides.
- Introduced `ObserverSurfaceSecrets` and `WebhookSurfaceSecrets` for managing secrets.
- Developed `RuntimeSurfaceFsClient` and `WebhookSurfaceFsClient` for manifest retrieval.
- Added dependency injection tests for `SurfaceEnvironmentRegistration` in both Observer and Webhook contexts.
- Implemented tests for secret resolution in `ObserverSurfaceSecretsTests` and `WebhookSurfaceSecretsTests`.
- Created `EnsureLinkNotMergeCollectionsMigrationTests` to validate MongoDB migration logic.
- Added project files for MongoDB tests and NuGet package mirroring.

src/Excititor/StellaOps.Excititor.WebService/Program.cs

@@ -4,6 +4,7 @@ using System.Linq;
 using System.Collections.Immutable;
 using System.Globalization;
 using System.Text;
+using System.Text.Json;
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
@@ -51,11 +52,12 @@ services.AddOptions<ExcititorObservabilityOptions>()
 services.AddScoped<ExcititorHealthService>();
 services.AddExcititorAocGuards();
 services.AddVexExportEngine();
-services.AddVexExportCacheServices();
+services.AddVexExportCacheServices();
 services.AddVexAttestation();
 services.Configure<VexAttestationClientOptions>(configuration.GetSection("Excititor:Attestation:Client"));
 services.Configure<VexAttestationVerificationOptions>(configuration.GetSection("Excititor:Attestation:Verification"));
-services.AddVexPolicy();
+services.AddVexPolicy();
+services.AddSingleton<IVexEvidenceChunkService, VexEvidenceChunkService>();
 services.AddRedHatCsafConnector();
 services.Configure<MirrorDistributionOptions>(configuration.GetSection(MirrorDistributionOptions.SectionName));
 services.AddSingleton<MirrorRateLimiter>();
@@ -515,6 +517,69 @@ app.MapGet("/v1/vex/observations/{vulnerabilityId}/{productKey}", async (
     return Results.Json(response);
 });
 
+app.MapGet("/v1/vex/evidence/chunks", async (
+    HttpContext context,
+    [FromServices] IVexEvidenceChunkService chunkService,
+    [FromServices] IOptions<VexMongoStorageOptions> storageOptions,
+    CancellationToken cancellationToken) =>
+{
+    var scopeResult = ScopeAuthorization.RequireScope(context, "vex.read");
+    if (scopeResult is not null)
+    {
+        return scopeResult;
+    }
+
+    if (!TryResolveTenant(context, storageOptions.Value, requireHeader: false, out var tenant, out var tenantError))
+    {
+        return tenantError;
+    }
+
+    var vulnerabilityId = context.Request.Query["vulnerabilityId"].FirstOrDefault();
+    var productKey = context.Request.Query["productKey"].FirstOrDefault();
+    if (string.IsNullOrWhiteSpace(vulnerabilityId) || string.IsNullOrWhiteSpace(productKey))
+    {
+        return ValidationProblem("vulnerabilityId and productKey are required.");
+    }
+
+    var providerFilter = BuildStringFilterSet(context.Request.Query["providerId"]);
+    var statusFilter = BuildStatusFilter(context.Request.Query["status"]);
+    var since = ParseSinceTimestamp(context.Request.Query["since"]);
+    var limit = ResolveLimit(context.Request.Query["limit"], defaultValue: 200, min: 1, max: 500);
+
+    var request = new VexEvidenceChunkRequest(
+        tenant,
+        vulnerabilityId.Trim(),
+        productKey.Trim(),
+        providerFilter,
+        statusFilter,
+        since,
+        limit);
+
+    VexEvidenceChunkResult result;
+    try
+    {
+        result = await chunkService.QueryAsync(request, cancellationToken).ConfigureAwait(false);
+    }
+    catch (OperationCanceledException)
+    {
+        return Results.StatusCode(StatusCodes.Status499ClientClosedRequest);
+    }
+
+    context.Response.Headers["X-Total-Count"] = result.TotalCount.ToString(CultureInfo.InvariantCulture);
+    context.Response.Headers["X-Truncated"] = result.Truncated ? "true" : "false";
+    context.Response.ContentType = "application/x-ndjson";
+
+    var options = new JsonSerializerOptions(JsonSerializerDefaults.Web);
+    foreach (var chunk in result.Chunks)
+    {
+        var line = JsonSerializer.Serialize(chunk, options);
+        await context.Response.WriteAsync(line, cancellationToken).ConfigureAwait(false);
+        await context.Response.WriteAsync("\n", cancellationToken).ConfigureAwait(false);
+    }
+
+    return Results.Empty;
+});
+
 app.MapPost("/aoc/verify", async (
     HttpContext context,
     VexAocVerifyRequest? request,