[rbardaji]

Closes #375.

What

1. Per-install credentials for the bundled MongoDB and MinIO.
   • Generated by a new installation, stored in .env.install-state and reused on re-runs.
   • docker-compose.yml reads them: ${MONGODB_ROOT_PASSWORD:-admin123} (new in example.env, also used by mongo-express) and ${S3_ACCESS_KEY:-minioadmin} / ${S3_SECRET_KEY:-minioadmin123}.
   • An Endpoint whose service already holds data keeps the credentials it was created with. They are taken from the state, the current .env, or the existence of its data volume. The installer warns about it, and docs/operations.md explains how to change it.
2. Pinned, verified NetBird client.
   • Replaces curl pkgs.netbird.io/install.sh | sudo sh.
   • The installer downloads the release pinned in install/netbird.sha256 (0.81.3, linux amd64/arm64) and installs it only if its SHA-256 matches; then it runs netbird service install / service start.
   • Hosts that already have netbird are not touched.
3. CKAN_VERIFY_SSL=False is announced. A warning is printed on every run, and the trade-off is documented in docs/configuration.md.

Tests

• New install/tests/test_bundled_credentials.py: 15 tests, 10 of which fail on main.
• New NetBird pinned-install tests in install/tests/test_netbird_affinities.py.
• test_render_env.py: the shape assertion was updated for the new helper.
• Real tests on a laptop with Docker:
  • New Endpoint (MongoDB + MinIO + access requests): it used generated credentials, and creating an organization and a bucket through the API worked. admin123 was refused by MongoDB. A re-run kept the credentials and the data.
  • Upgrade: an Endpoint installed with v0.34.61 and upgraded kept admin123, with the warning, and its data. The documented password change then worked: healthy, and admin123 refused.
  • NetBird: 0.81.3 was downloaded from GitHub and verified. A tampered checksum was refused.

Release 0.34.62.