feat(deps): make the MongoDB driver an optional dependency

[ashleycaselli]

Closes #166

nanopub-java declared the legacy all-in-one org.mongodb:mongo-java-driver 3.12.14 (end of life) as a compile dependency. So every project using the library got a copy of com.mongodb.* and org.bson.*, which clashed with the modern driver in projects that declare one themselves (knowledgepixels/nanopub-registry#180).

Changes

• Dependency: org.mongodb:mongodb-driver-sync 5.13.0, marked <optional>true</optional>. It is now only on the classpath of projects that declare a driver themselves.
• NanopubDb: ported from the legacy API (com.mongodb.MongoClient, DB, DBCollection, BasicDBObject) to the current one (MongoClients.create(MongoClientSettings), MongoDatabase, MongoCollection<Document>, Filters.eq). Same connection parameters and behaviour. getMongoClient() now returns com.mongodb.client.MongoClient; nothing in the known dependent projects calls it.
• NanopubStream: unchanged, since MongoCursor, Document and Binary are the same in the new driver.
• README: notes that projects using NanopubDb or NanopubStream.fromMongoCursor must declare mongodb-driver-sync themselves.

CLI jar

The cli profile's assembly (jar-with-dependencies) packs the project's own optional dependencies, so the driver (mongodb-driver-sync, mongodb-driver-core, bson) is in the CLI jar without changes to the profile. Checked by:

• listing the jar's contents;
• running get --mongodb-host 127.0.0.1 --mongodb-port 1 … from the packed jar, which reaches the driver and times out on the closed port with a MongoTimeoutException, not a NoClassDefFoundError.

The driver is deliberately not added to the cli profile, as that profile activates whenever CI is set and could then bring the driver back into dependent builds on CI.

Verified

• Without the driver on the classpath: GetNanopub, NanopubStream, FetchIndexFromDb, Run and NanopubImpl load and pass bytecode verification, and nanopubs parse.
• Downstream: with the snapshot installed locally, nanodash's dependency tree no longer contains a MongoDB driver (before: mongo-java-driver 3.12.14). nanopub-registry declares mongodb-driver-sync itself.
• New NanopubDbTest: with a mocked client, it checks the connection settings with and without credentials, the _id lookup, reading a stored nanopub from the test suite, an unknown artifact code, and isAccessible().
• Full suite: 1279 tests, 0 failures.

🤖 Generated with Claude Code