Migrate IWRS from MySQL to MongoDB

- Add IWRS/common/mongo_writer.py with shared connection, indexes,
  upsert+snapshot helpers
- Add IWRS/Patients/import_to_mongo.py (subject_summary + visits)
- Add IWRS/Patients/import_notifications_to_mongo.py: parse PDF/JSON
  directly to Mongo (incl. PDF as BinData), replaces 2-step MySQL flow
- Add IWRS/Drugs/import_to_mongo.py (shipments, items, inventory,
  destruction)
- Add IWRS/backfill_mysql_to_mongo.py: one-shot history backfill
- Switch IWRS/Patients/run_all.py and IWRS/Drugs/run_all.py to Mongo
- Rewrite IWRS/Drugs/create_report.py data loaders to read from Mongo
- 8 main collections (upsert = latest state) + 5 snapshot collections
  (append-only with import_id) under studie database; notifications and
  destruction are immutable and need no snapshots

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

TODO.md

@@ -0,0 +1,6 @@
+# TODO
+
+## Bezpečnost Tower / síť
+- [ ] Vyndat heslo roota (7309208104) z `Python-runner/python_runner.md` a skriptů → `.env` / proměnná prostředí
+- [ ] MySQL tunely z ordinace převést na SSH klíč, pak na Toweru vypnout `PasswordAuthentication`
+- [x] Omezit SSH Toweru (NAT pravidlo 27 na MikroTiku) na IP ordinace přes address-list `ordinace` (78.44.195.114, 185.140.244.138) — 2026-06-02