Keep a host with no primary MAC loadable, and self-heal it

[mastacontrola]

Port of working-1.6's 1cd7446f6, plus the tests that commit did not ship.

The bug

$databaseFieldClassRelationships entries may carry an optional 4th element — a filter on the joined table. Exactly one exists in the whole codebase, and it is load-bearing:

'MACAddressAssociation' => array('hostID', 'id', 'primac', array('primary' => 1))

so that $host->get('primac') is the host's primary MAC rather than whichever row came back first. buildQuery() emitted that filter into $whereArrayAnd — and a WHERE predicate on the right-hand table of a LEFT OUTER JOIN is not a filter, it is an INNER JOIN written the long way. Rows with nothing to join to are dropped by the WHERE, so a host with no hmPrimary='1' row stopped existing:

new Host($id)->isValid()           -> false
HostManager->find(['id' => $id])   -> 0 objects
GET /fog/host/$id                  -> 404

on a row sitting in the table. Un-loadable, un-editable, un-deletable. Verified against a 2079-host database in which 1953 hosts have no primary MAC.

buildQuery() recurses, so the same predicate reached every class whose relationship chain passes through Host: Task, SnapinJob, SnapinTask, ImagingLog, NodeFailure, UserTracking, LocationAssociation, SiteHostAssociation. A task belonging to such a host was invisible to TaskManager — the half that turns a display bug into an operational one, and the reason Site::hostIDsForSites() had to read siteHostAssoc directly in #1233. That direct read is now belt and braces rather than the only thing holding.

How a host loses its primary MAC: an update that replaces the MAC set, a primary MAC deleted, a MAC left pending, or a host created through the API or a CSV import with no MAC at all.

The fix

1. FOGController::buildQuery() — the relationship filter is emitted into the JOIN ON clause instead of WHERE. One change, every caller. The $whereInfo closure it was the sole user of goes with it.
2. Host::save() — promotes the first remaining approved (non-pending) MAC when nothing is flagged primary, so an update that replaces the MAC set cannot strand the host again. It leaves a pending MAC pending (approving an unapproved MAC as a side effect of an unrelated save would be a worse bug than the one being fixed) and does nothing when a primary already exists.

Tests

Two arms, because they catch different regressions. Both were written failing, and every gate was mutation-verified.

File	Needs a DB	Catches
tests/relationship-filter-in-join.test.php	no	filter moved back to WHERE; join turned INNER; filter dropped entirely. Reads the emitted SQL, so this is the arm that gates CI
tests/macless-host-reachable.test.php	yes (SKIPs without one)	five host shapes driven through load(), find(), a transitive TaskManager lookup and all four self-heal cases

sh tests/run-all.sh — 19 passed, 0 failed.

Also on working-1.6

relationship-filter-in-join.test.php is being added there too: that branch has carried the fix since June with no test.