Group Mongo bootstrap secrets under infrastructure ownership

docs/implementation.md

@@ -743,3 +743,11 @@ and 1,083 expected HTTP responses, zero failures. Role TTLs were restored and
 temporary BFF/frontend containers removed. `make up` intentionally stops at the
 missing Resend credential check; no real email, optional security scan or merge
 was performed. Earlier supplementary legacy test limitations remain recorded.
+
+Mongo bootstrap credentials now live at `kv/infrastructure/mongo/bootstrap`,
+consistent with component ownership. The live `kv/bootstrap/mongo` value was
+copied, compared and archived before removing the old path. Bootstrap and admin
+checks read the new path; application identities are denied both paths. Shell
+checks and live infrastructure validation (including Mongo transactions, lease
+renewal/revocation and obsolete-path absence) passed. `make up` still stops at the
+expected missing-Resend check. No backend code or product behavior changed.