TypeScript: implement Mongoose and MongoDB Node driver sink extraction

[bjcorder]

Parent

Part of #89.

Context

Many TypeScript apps use MongoDB directly or through Mongoose. Rulepath should analyze business-logic invariants in document access and updates, including object scope and server-owned field mutation risks.

References:

• Mongoose documentation: https://mongoosejs.com/docs/
• MongoDB Node.js driver: https://www.mongodb.com/docs/drivers/node/current/

Scope

• Detect Mongoose models, schemas, query helpers, model, Model imports, and common repository wrappers.
• Detect Mongoose operations such as findById, findOne, find, create, save, updateOne, updateMany, findOneAndUpdate, replaceOne, deleteOne, deleteMany, aggregate, and bulk writes.
• Detect MongoDB Node driver collection operations such as findOne, find, insertOne, insertMany, updateOne, updateMany, replaceOne, deleteOne, deleteMany, aggregate, and bulk writes.
• Extract resource/collection/model, operation type, filters, mutation fields/update operators, bulk flag, spans, and normalized sink expression.
• Track request-controlled values into _id, filter documents, update documents, $set, $inc, $push, replacement documents, and aggregation match stages.
• Recognize tenant/object scope fields, authorization evidence, and configured helpers.
• Treat complex dynamic aggregation/update pipelines conservatively.

Acceptance Criteria

• MongoDB/Mongoose unsafe fixtures emit expected findings for unscoped object access, unsafe client-controlled update fields, and bulk mutation scope issues.
• Safe fixtures recognize tenant/object filters and safe update allowlists.
• Document-oriented update operators are mapped to mutation field facts.
• Async service traces preserve source IDs and call path frames.

Test Plan

• Add data-layer unit tests for Mongoose and MongoDB driver CRUD, updates, bulk writes, aggregation, and dynamic uncertainty.
• Add NestJS/Fastify/Hono fixtures with MongoDB safe and unsafe cases.
• Assert JSON sink metadata, mutation fields, and source IDs.
• Run cargo fmt --all -- --check, cargo clippy --locked --workspace --all-targets, and cargo test --locked --workspace.