feat(onboarding): unified multi-target model + scan matrix foundation (#134)

compliance-agent/src/database.rs

@@ -428,6 +428,36 @@ impl Database {
             )
             .await?;
 
+        // onboarded_targets: multikey on artifact source ref (webhook + dedupe
+        // lookup). Non-unique — "one git URL per tenant" is enforced in the
+        // create handler, since a unique multikey index on an array field has
+        // null-collision caveats.
+        self.onboarded_targets()
+            .create_index(
+                IndexModel::builder()
+                    .keys(doc! { "artifacts.source_ref": 1 })
+                    .build(),
+            )
+            .await?;
+
+        // onboarded_targets: multikey on artifact kind
+        self.onboarded_targets()
+            .create_index(
+                IndexModel::builder()
+                    .keys(doc! { "artifacts.kind": 1 })
+                    .build(),
+            )
+            .await?;
+
+        // onboarded_targets: target_type filter
+        self.onboarded_targets()
+            .create_index(
+                IndexModel::builder()
+                    .keys(doc! { "target_type": 1 })
+                    .build(),
+            )
+            .await?;
+
         tracing::info!("Database indexes ensured");
         Ok(())
     }
@@ -484,6 +514,13 @@ impl Database {
         self.inner.collection("dast_targets")
     }
 
+    /// The unified onboarding targets that replace `repositories` and
+    /// `dast_targets`. Ids are preserved from the legacy collections during
+    /// migration so downstream `repo_id` / `target_id` references keep resolving.
+    pub fn onboarded_targets(&self) -> Collection<OnboardedTarget> {
+        self.inner.collection("onboarded_targets")
+    }
+
     pub fn dast_scan_runs(&self) -> Collection<DastScanRun> {
         self.inner.collection("dast_scan_runs")
     }