feat(m2m): NoSQL provider implementations for ServiceAccount + TrustedIssuer [Phase 1 — PR 2/5]

[lakhansamani]

Summary

Replaces the "not implemented" stubs from PR 1 with full CRUD implementations across all 5 NoSQL storage providers.

Chains on: #641 (must merge first)

Providers to implement

Each provider gets two files following the pattern of the existing webhook.go in that provider directory:

Provider	Files
MongoDB (storage/db/mongodb/)	service_account.go, trusted_issuer.go
ArangoDB (storage/db/arangodb/)	service_account.go, trusted_issuer.go
CassandraDB (storage/db/cassandradb/)	service_account.go, trusted_issuer.go + DDL in provider.go
DynamoDB (storage/db/dynamodb/)	service_account.go, trusted_issuer.go + table creation in provider.go
Couchbase (storage/db/couchbase/)	service_account.go, trusted_issuer.go

CassandraDB DDL (must be added to cassandradb/provider.go — no AutoMigrate):

CREATE TABLE IF NOT EXISTS authorizer_service_accounts (
  id text PRIMARY KEY,
  name text, description text, client_secret text,
  allowed_scopes text, is_active boolean,
  created_at bigint, updated_at bigint
);

CREATE TABLE IF NOT EXISTS authorizer_trusted_issuers (
  id text PRIMARY KEY,
  service_account_id text, name text, issuer_url text,
  key_source_type text, jwks_url text, expected_aud text,
  subject_claim text, issuer_type text, auth_method text,
  is_active boolean, enable_token_review boolean,
  kubernetes_api_server_url text,
  spiffe_refresh_hint_seconds bigint,
  trusted_proxy_header text, trusted_proxy_cidrs text,
  created_at bigint, updated_at bigint
);

PR chain

PR 1 — schema + interface + SQL + constants  →  main        ✅ #641
PR 2 — NoSQL provider implementations        →  PR 1        🔄 this PR
PR 3 — service layer + admin GraphQL API     →  PR 2
PR 4 — gRPC admin RPCs                       →  PR 3
PR 5 — client_credentials grant + tests      →  PR 4

Test plan

• make test-all-db green across all 7 backends
• make lint clean