Shared secrets in Terraform, and a bug in InsertOne

Moved the secrets and the config to shared Terraform resources. Every chart had its own copy of the same values, which was fine with three services and stupid with sixteen. The Helm charts got a lot smaller after that.

Then a real bug: InsertOne was not setting TTLHours and Bucket, so single inserts were writing rows that behave differently from the ones written in batch. InsertMany got simplified while I was there, and both have tests now.