Add unit tests and implementations for MongoDB index models and OpenAPI metadata

- Implemented `MongoIndexModelTests` to verify index models for various stores.
- Created `OpenApiMetadataFactory` with methods to generate OpenAPI metadata.
- Added tests for `OpenApiMetadataFactory` to ensure expected defaults and URL overrides.
- Introduced `ObserverSurfaceSecrets` and `WebhookSurfaceSecrets` for managing secrets.
- Developed `RuntimeSurfaceFsClient` and `WebhookSurfaceFsClient` for manifest retrieval.
- Added dependency injection tests for `SurfaceEnvironmentRegistration` in both Observer and Webhook contexts.
- Implemented tests for secret resolution in `ObserverSurfaceSecretsTests` and `WebhookSurfaceSecretsTests`.
- Created `EnsureLinkNotMergeCollectionsMigrationTests` to validate MongoDB migration logic.
- Added project files for MongoDB tests and NuGet package mirroring.

src/Zastava/StellaOps.Zastava.Observer/Secrets/ObserverSurfaceSecrets.cs

@@ -0,0 +1,58 @@
+using Microsoft.Extensions.Options;
+using StellaOps.Scanner.Surface.Env;
+using StellaOps.Scanner.Surface.Secrets;
+using StellaOps.Zastava.Core.Configuration;
+using StellaOps.Zastava.Observer.Configuration;
+
+namespace StellaOps.Zastava.Observer.Secrets;
+
+internal interface IObserverSurfaceSecrets
+{
+    ValueTask<CasAccessSecret> GetCasAccessAsync(string? name, CancellationToken cancellationToken = default);
+    ValueTask<AttestationSecret> GetAttestationAsync(string? name, CancellationToken cancellationToken = default);
+}
+
+internal sealed class ObserverSurfaceSecrets : IObserverSurfaceSecrets
+{
+    private const string Component = "Zastava.Observer";
+
+    private readonly ISurfaceSecretProvider _provider;
+    private readonly IOptions<ZastavaRuntimeOptions> _runtime;
+    private readonly IOptions<ZastavaObserverOptions> _observer;
+
+    public ObserverSurfaceSecrets(
+        ISurfaceSecretProvider provider,
+        IOptions<ZastavaRuntimeOptions> runtime,
+        IOptions<ZastavaObserverOptions> observer)
+    {
+        _provider = provider ?? throw new ArgumentNullException(nameof(provider));
+        _runtime = runtime ?? throw new ArgumentNullException(nameof(runtime));
+        _observer = observer ?? throw new ArgumentNullException(nameof(observer));
+    }
+
+    public async ValueTask<CasAccessSecret> GetCasAccessAsync(string? name, CancellationToken cancellationToken = default)
+    {
+        var options = _observer.Value.Secrets;
+        var request = new SurfaceSecretRequest(
+            Tenant: _runtime.Value.Tenant,
+            Component: Component,
+            SecretType: "cas-access",
+            Name: string.IsNullOrWhiteSpace(name) ? options.CasAccessName : name);
+
+        var handle = await _provider.GetAsync(request, cancellationToken).ConfigureAwait(false);
+        return SurfaceSecretParser.ParseCasAccessSecret(handle);
+    }
+
+    public async ValueTask<AttestationSecret> GetAttestationAsync(string? name, CancellationToken cancellationToken = default)
+    {
+        var options = _observer.Value.Secrets;
+        var request = new SurfaceSecretRequest(
+            Tenant: _runtime.Value.Tenant,
+            Component: Component,
+            SecretType: "attestation",
+            Name: string.IsNullOrWhiteSpace(name) ? options.AttestationName : name);
+
+        var handle = await _provider.GetAsync(request, cancellationToken).ConfigureAwait(false);
+        return SurfaceSecretParser.ParseAttestationSecret(handle);
+    }
+}

src/Zastava/StellaOps.Zastava.Observer/Surface/RuntimeSurfaceFsClient.cs

@@ -0,0 +1,32 @@
+using StellaOps.Scanner.Surface.Env;
+using StellaOps.Scanner.Surface.FS;
+
+namespace StellaOps.Zastava.Observer.Surface;
+
+internal interface IRuntimeSurfaceFsClient
+{
+    Task<SurfaceManifestDocument?> TryGetManifestAsync(string manifestDigest, CancellationToken cancellationToken = default);
+}
+
+internal sealed class RuntimeSurfaceFsClient : IRuntimeSurfaceFsClient
+{
+    private readonly ISurfaceManifestReader _manifestReader;
+    private readonly SurfaceEnvironmentSettings _environment;
+
+    public RuntimeSurfaceFsClient(ISurfaceManifestReader manifestReader, SurfaceEnvironmentSettings environment)
+    {
+        _manifestReader = manifestReader ?? throw new ArgumentNullException(nameof(manifestReader));
+        _environment = environment ?? throw new ArgumentNullException(nameof(environment));
+    }
+
+    public Task<SurfaceManifestDocument?> TryGetManifestAsync(string manifestDigest, CancellationToken cancellationToken = default)
+    {
+        if (string.IsNullOrWhiteSpace(manifestDigest))
+        {
+            return Task.FromResult<SurfaceManifestDocument?>(null);
+        }
+
+        // manifest digests follow sha256:<hex>; manifest reader handles validation and tenant discovery
+        return _manifestReader.TryGetByDigestAsync(manifestDigest.Trim(), cancellationToken);
+    }
+}