Convert four hal modules: lidarr, mongodb, mssql, mosquitto

Mirrors the proven catalog patterns field-for-field:
- lidarr  -> the Servarr twin of radarr/sonarr (API v1, artist content); no
  provisioner (it is a consumer app).
- mongodb -> postgres shape: mongodb-database provider, provisioner mints a
  per-consumer db+user (ADR 0053), client shells to mongosh (no npm driver,
  the psql convention).
- mssql   -> postgres shape: mssql-database provider, sqlcmd client.
- mosquitto -> redis shape: mqtt-topic provider via the Dynamic Security
  plugin, deliberately avoiding hal's password_file (that file is nox issue
  011 exactly); provisioner mints a per-consumer MQTT client+role.

All four typecheck (strict, NodeNext) against the built @novox/mesh-sdk, and
their service images are digest-pinned to resolved registry digests. The
mesh-runtime-<mod> images keep the all-zeros placeholder the pipeline pins,
as postgres/redis do, and must bundle each module's CLI (mongosh/sqlcmd/
mosquitto_ctrl) as mesh-runtime-postgres bundles psql.

Not yet lab-verified: each module lists in-code what an integration test must
prove (auth model, provisioner reconcile, mosquitto dynsec bootstrap ordering).

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

modules/mongodb/index.ts

@@ -0,0 +1,25 @@
+// mongodb's events entrypoint, loaded by the per-node tool host (the provisioner container runs
+// ./provisioner separately). The database lifecycle events are EMITTED from the provisioner, where
+// the lifecycle actually happens (novox/hq ADR 0046/0047):
+//   module.mongodb.database.provisioned    — a consumer's database + owning user was created
+//   module.mongodb.database.deprovisioned  — that database was removed
+// Here in the tool host we react to them, keeping a lightweight audit trail of who was granted a
+// database and who lost one — observability the provider itself is best placed to log.
+
+import { on } from "@novox/mesh-sdk/events";
+
+interface DatabaseEvent {
+  consumer: string;
+  database: string;
+  user?: string;
+}
+
+await on<DatabaseEvent>("module.mongodb.database.provisioned", async (e) => {
+  console.log(`[mongodb] database provisioned for ${e.body.consumer} (db ${e.body.database})`);
+});
+
+await on<DatabaseEvent>("module.mongodb.database.deprovisioned", async (e) => {
+  console.log(`[mongodb] database deprovisioned for ${e.body.consumer} (db ${e.body.database})`);
+});
+
+console.log("[mongodb] auditing database lifecycle events");