#1924 Use direct role lookups instead of broad role scans

[ChenyangLi4288]

Closes Issue #1924

Summary

isSecretariat, isSecretariatUUID, and isBulkDownload previously fetched every org holding the role and compared UUIDs in a loop. Each check is now a single findOne with the role in the query predicate, so role checks are direct indexed lookups instead of unbounded collection scans.

Important Changes

src/utils/utils.js

• isSecretariat now runs one findOne per check with both short_name and the SECRETARIAT role in the query (the registry and legacy branches each queried a single collection, so the two queries collapse safely). The options object (e.g. a session) now also applies to the role check.
• isSecretariatUUID now runs a single findOne on BaseOrg by UUID + role, and returns false early for a falsy UUID without querying.
• isBulkDownload keeps its legacy short_name -> UUID resolution (the original intentionally mixes the legacy Org and registry BaseOrg collections), but the role check is now a direct UUID + role findOne instead of scanning all BULK_DOWNLOAD orgs.
• All queries project only UUID and use lean execution; return semantics are unchanged (missing org, falsy UUID, or role-not-held all still return false).

Testing

Verified:

• Full unit suite passes (npm run action:test, 337 tests).
• Old and new implementations were run side-by-side against a real MongoDB seeded with both legacy Org and registry BaseOrg collections (multi-role secretariat, CNA, BULK_DOWNLOAD, ADP, a legacy-only org, and nonexistent names). All 27 input combinations returned identical results, including edge inputs (null/undefined/"" UUIDs) and the legacy-vs-registry divergence case.

Notes

• No test changes were needed: all existing tests mock at the repository layer; none stub the model-level find calls the old implementation used.