* update mongoose, jest and nodemon to address security alerts triggered
  by dependabot
* 'test' target had a bug introduced by using wrong syntax
* renamed server scripts to clarify the distinction between invocations
  in local development, CI and actual operations