19e38dade4
{ new: true } only applies to findOneAndUpdate, not updateMany - it was
always a silent no-op here. Harmless until a stricter mongoose/mongodb
type resolution (no lockfile is committed, so installs float) rejected
it outright, breaking `npm run build` inside the Docker image.