[david-rocca]

Closes Issue #1984

Summary

GET /api/registry/users exposed Mongoose’s internal __v field. The aggregation now excludes it alongside _id and secret.

Important Changes

src/repositories/baseUserRepository.js

• Exclude __v from the user-list aggregation projection.

test/integration-tests/user/getUsersTest.js

• Extend existing registry and legacy list tests to verify internal fields are omitted.
• Verify registry users retain their public identity, status, and timestamp fields.

test/unit-tests/user/baseUserRepositoryFormatSemanticsTest.js

• Update the existing projection expectation to include the __v exclusion.

Testing

• Reproduced the failure using the updated existing integration test before applying the fix.
• bash -i -c "npm run test:integration:replicas" — 998 passing.
• ESLint and whitespace checks passed.

Manual verification:

• GET /api/registry/users as Secretariat and confirm every user excludes __v, _id, and secret.
• Confirm public user fields are present and GET /api/users retains its legacy response format.

Notes

• Updated existing tests only; no new test cases or files.
• Confidence: 9/10. The regression was reproduced before the fix and the full integration suite passed afterward; production DocumentDB was not exercised.