Add MongoDB TLS options (`tlsAllowInvalidCertificates`, `retryWrites`, `tlsCAFile`) to the connection form with backend URL normalization and DocumentDB/SSH tunnel guidance, while preserving legacy `tlsCAFile` in `url_params` for existing DocumentDB users, hardening auth failure hint matching, and clarifying TLS bypass security labels.