feat: report on changes as well as facts

[blaipr]

Closes #22.

Problem

The Changes page has filters for host, job template, playbook, role, module, job type, inventory and project, and a search over the change data, but that view is only ever a session. It cannot be saved, handed to someone else, or mailed on a schedule. Reports can do all three, and they only build from facts.

The roles filter the issue also asked for was added separately in 3569435.

Change

A report now has a type, and a changes report is the Changes page saved as a report.

• reports.type is facts or changes, defaulting to facts, added by a database upgrade so existing reports keep working untouched.
• A changes report is filtered on the fields the Changes page filters on, plus Last Hours, a window that makes a scheduled report cover last night rather than everything ever recorded. One filter per field, as on that page, and the values offered are the ones the recorded changes actually hold.
• Its columns are fixed to what that page lists: time, host, job template, playbook, role, task and module. It returns the same row shape a facts report does, so the report view, the CSV, Excel and PDF buttons, and the scheduled email all render it without knowing which kind of report it is.
• Permissions, sorting, scheduling and mailing are the ones reports already have. The column editor is not offered for a changes report, and its actions are refused for one.

Filter values are bound rather than interpolated into the query.

The Reports list gains a Type column and a second create button, and /reports/new/changes is routed to it.

Testing

Rendered and run against MariaDB in containers, with the schema from ledger.sql and a few seeded changes:

• 32 checks over the report class and the builder pass: the type round trips, setting a field twice replaces the filter rather than adding a second, each of the nine filters and the time window select the rows they should, unknown fields and empty values are refused, and a value carrying ' OR '1'='1 matches nothing rather than widening the query
• the filter menus list the hosts, templates, playbooks, roles, modules, inventories and projects the seeded changes hold
• the upgrade path was run from a database at version 17: the column is added and existing reports read as facts
• report_changes_edit.html, report.html, reports.html and the report email compile and render with representative data, showing the current filters as selected, the delete links per field, and both report types in the list
• php -l passes on every changed file

Not run inside a deployed Ledger, so the pages have not been clicked through in a browser.

[ciq-it-service-account]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.