feat: modernize private read-only global region API

[ferreiraad]

Context

The legacy region service mixed obsolete CRUD endpoints, local authorization logic, and incomplete MongoDB models. Frontend applications need a governed global geography catalog through ioterax-bff, while ingestion remains owned by worker-region.

Closes #3.

Scope

• Rebuilds the service as a private, read-only NestJS API with explicit domain, application, adapter, infrastructure, and module boundaries.
• Exposes versioned country, administrative-division, place, localized-search, catalog, and active-release queries.
• Uses the public region contracts from @ioterax/foundation-lib-central and shared RegionCountryPermissions constants.
• Reads only MongoDB database foundation_central and filters every entity query through the atomic region_dataset_catalogs/global active-release pointer.
• Adds deterministic B-tree and MongoDB text-index planning/application without reconciling indexes at application startup.
• Adds bounded Prometheus business and technical metrics, protected ingress metrics, and an optional loopback-only sidecar listener.
• Migrates the repository to Node.js 26.6.0, Yarn 4.18.0, strict isolated Plug'n'Play, current NestJS tooling, documentation, and required CI.

Architecture and security

• Removes mutation routes and the legacy local authentication guard.
• Enforces shared authentication, request-context, Kong authorization, and RBAC guards on all business routes.
• Keeps MongoDB runtime access read-only with retryWrites: false; index management remains an explicit operational command for a separate identity.
• Uses strict bounded DTO validation and prevents sensitive or unbounded metric labels.
• Produces a non-root distroless PnP image with no node_modules or unplugged dependencies.
• Compresses the production PnP cache and strips unused native symbols, reducing the image from 301 MB to 188 MB locally.
• Overlays the exact signed Debian Security OpenSSL package because the current pinned distroless digest still contains a fixable high-severity advisory. No Trivy exception was added.

Validation

• yarn quality
• 68 unit tests passed
• Coverage: 98.21% statements, 92.06% branches, 99.08% functions, 98.98% lines
• yarn test:e2e: MongoDB 8.3.8 active-release isolation and localized search passed
• yarn security:audit: zero moderate-or-higher dependency vulnerabilities
• Stable and dev dependency-channel Docker builds passed
• Runtime verification passed for Node.js 26.6.0, UID 65532, strict PnP, no node_modules, and no unplugged dependencies
• Trivy 0.74.0: zero high/critical findings and zero fixable medium findings for stable and dev images
• Secret and AppleDouble audits passed

The manual mutation, pentest, and OWASP dependency-check suites were intentionally not executed because they require explicit authorization.

Deployment and follow-up

• Terraform/HCP Terraform remains responsible for the Cloud Run service shell, IAM, ingress, scaling, identities, and Secret Manager containers.
• GitHub Actions remains responsible for immutable application images, revisions, traffic, and rollback.
• This pull request does not deploy infrastructure or expose the service publicly.
• After this pull request is manually merged and issue feat-modernize-private-read-only-global-region-api #3 is closed, the ordered delivery continues with the ioterax-bff facade and then the root development Compose integration.