docs(mongodb): refine uninstall behavior and add operator recovery note

Update Data lifecycle section to address review feedback:
- Reflect the release-scoped users secret naming.
- Distinguish operator-driven PVC release from actual PV/data
  deletion (depends on StorageClass reclaimPolicy).
- Document that TLS secrets (<release>-ssl, <release>-ssl-internal)
  are not reclaimed automatically.
- Add a recovery note for the case where the operator is removed
  before the CR, leaving finalizers unable to run.

Signed-off-by: Arsolitt <arsolitt@gmail.com>

packages/apps/mongodb/README.md

@@ -35,6 +35,41 @@ When `external: true` is enabled:
 On first install, the credentials secret will be empty until the Percona operator initializes the cluster.
 Run `helm upgrade` after MongoDB is ready to populate the credentials secret with the actual password.
 
+### Data lifecycle
+
+When the MongoDB release is uninstalled, the operator finalizers reclaim release-scoped resources:
+
+**Reclaimed by the `percona.com/delete-psmdb-pvc` finalizer:**
+
+- All PVCs backing the replica set storage. Whether the underlying PersistentVolume and on-disk data are actually deleted depends on the StorageClass `reclaimPolicy` (`Delete` removes them, `Retain` leaves them for manual cleanup).
+- Operator-managed secrets:
+  - `<release>-percona-server-mongodb-users` — operator users credentials
+  - `internal-<release>` — internal operator state
+  - `internal-<release>-users` — operator-internal users data
+  - `<release>-mongodb-encryption-key` — at-rest encryption key
+
+**Reclaimed by `helm uninstall`:**
+
+- `<release>-credentials` — connection string for application code
+- `<release>-user-<username>` — per-user passwords
+- `<release>-s3-creds` — backup destination credentials (if backups are configured)
+
+**Not reclaimed automatically:**
+
+- TLS secrets `<release>-ssl` and `<release>-ssl-internal` (issued by cert-manager) remain in the namespace after uninstall. Delete them manually if no longer needed.
+
+**Recovery from a stuck deletion:**
+
+If the `psmdb-operator` is uninstalled before MongoDB CRs are deleted, the finalizers cannot run and the `PerconaServerMongoDB` CR hangs in `Terminating`. To recover, clear the finalizers manually:
+
+```bash
+kubectl --namespace <namespace> patch psmdb <release> --type merge --patch '{"metadata":{"finalizers":[]}}'
+```
+
+Note that this skips the operator-driven cleanup — PVCs and operator-managed secrets will remain orphaned and must be removed manually.
+
+If you need to retain data, take a backup before deletion. Refer to the [Percona Operator for MongoDB documentation](https://docs.percona.com/percona-operator-for-mongodb/) for backup/restore workflows.
+
 ## Parameters
 
 ### Common parameters

packages/apps/mongodb/templates/mongodb.yaml

@@ -4,9 +4,14 @@ apiVersion: psmdb.percona.com/v1
 kind: PerconaServerMongoDB
 metadata:
   name: {{ .Release.Name }}
+  finalizers:
+    - percona.com/delete-psmdb-pods-in-order
+    - percona.com/delete-psmdb-pvc
 spec:
   crVersion: 1.21.1
   clusterServiceDNSSuffix: svc.{{ $clusterDomain }}
+  secrets:
+    users: {{ .Release.Name }}-percona-server-mongodb-users
   pause: false
   unmanaged: false
   image: percona/percona-server-mongodb:{{ include "mongodb.versionMap" $ }}

packages/apps/mongodb/tests/mongodb_test.yaml

@@ -38,6 +38,70 @@ tests:
           value: my-mongodb
         documentIndex: 0
 
+  ##################
+  # Finalizers     #
+  ##################
+
+  - it: renders Percona finalizers on PSMDB CR
+    release:
+      name: test-mongodb
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - contains:
+          path: metadata.finalizers
+          content: percona.com/delete-psmdb-pvc
+        documentIndex: 0
+      - contains:
+          path: metadata.finalizers
+          content: percona.com/delete-psmdb-pods-in-order
+        documentIndex: 0
+
+  - it: renders Percona finalizers in sharded mode
+    release:
+      name: test-mongodb
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+      sharding: true
+      shardingConfig:
+        configServers: 3
+        configServerSize: 3Gi
+        mongos: 2
+        shards:
+          - name: rs0
+            replicas: 3
+            size: 10Gi
+    asserts:
+      - contains:
+          path: metadata.finalizers
+          content: percona.com/delete-psmdb-pvc
+        documentIndex: 0
+      - contains:
+          path: metadata.finalizers
+          content: percona.com/delete-psmdb-pods-in-order
+        documentIndex: 0
+
+  ##################
+  # Secrets        #
+  ##################
+
+  - it: scopes users secret name to the release for namespace isolation
+    release:
+      name: test-mongodb
+      namespace: tenant-test
+    set:
+      _cluster:
+        cluster-domain: cozy.local
+    asserts:
+      - equal:
+          path: spec.secrets.users
+          value: test-mongodb-percona-server-mongodb-users
+        documentIndex: 0
+
   ##################
   # CR Version     #
   ##################