Group Mongo bootstrap secrets under infrastructure ownership

docs/implementation.md

@@ -743,3 +743,11 @@ and 1,083 expected HTTP responses, zero failures. Role TTLs were restored and
 temporary BFF/frontend containers removed. `make up` intentionally stops at the
 missing Resend credential check; no real email, optional security scan or merge
 was performed. Earlier supplementary legacy test limitations remain recorded.
+
+Mongo bootstrap credentials now live at `kv/infrastructure/mongo/bootstrap`,
+consistent with component ownership. The live `kv/bootstrap/mongo` value was
+copied, compared and archived before removing the old path. Bootstrap and admin
+checks read the new path; application identities are denied both paths. Shell
+checks and live infrastructure validation (including Mongo transactions, lease
+renewal/revocation and obsolete-path absence) passed. `make up` still stops at the
+expected missing-Resend check. No backend code or product behavior changed.

docs/local-development.md

@@ -41,10 +41,9 @@ kv/
 │   └── notifications/
 │       ├── callers/bff                 # token; read by BFF and notifications
 │       └── email/resend                # driver, api_key, sender_address, sender_name
-├── infrastructure/
-│   └── nats/auth                       # token; read by NATS and notifications
-└── bootstrap/
-    └── mongo                           # local administrator and replica-set bootstrap material
+└── infrastructure/
+    ├── nats/auth                       # token; read by NATS and notifications
+    └── mongo/bootstrap                 # local administrator and replica-set bootstrap material
 ```
 
 Every secret has an owning service or infrastructure component. Service policies
@@ -130,7 +129,8 @@ still interrupt work. Repository consumers use `source.Source` operation scopes;
 ## Migration and persistence
 
 Bootstrap migrates the old flat `bff`, `caller`, `email` and `nats` paths into the
-hierarchy above. It copies with CAS protection, compares values, and refuses to
+hierarchy above, and moves `bootstrap/mongo` to `infrastructure/mongo/bootstrap`.
+It copies with CAS protection, compares values, and refuses to
 overwrite conflicting destinations. After consumers use the new paths, it removes
 old KV metadata and obsolete `tls`, `frontend-tls`, `notifications-tls` entries.
 Readable old version history and metadata are archived privately in