fix(delete): lifecycle handling for inherited hosts

[berlikm]

Summary

Replaces inherited-host lifecycle lookup by hostname with a durable ZabbixHostBinding model keyed by (Zabbix server, NetBox content type, object ID). All lifecycle operations (rename, exclusion, decommission, assignment removal, hard deletion) act on the bound hostid instead of hostname.

Safety properties

• First sync creates a binding; second sync reuses the same hostid
• Rename updates the Zabbix host in-place (same hostid, no duplicate)
• Exclusion, decommission, and assignment removal delete by bound hostid
• Hard deletion captures binding IDs before the object is deleted, enqueues via transaction.on_commit(), and retains failed bindings for bounded RQ retries
• Managed-tag backfill adopts existing Zabbix hosts by nb_type/nb_id tags
• Unmanaged same-name hosts and duplicate identity bindings fail closed
• Legacy direct-assignment hostid values migrate into bindings on first sync
• Both binding and legacy hostid fields use PositiveBigIntegerField

Reconciliation integration

The periodic sync candidate set is the union of:

currently covered objects ∪ objects with durable bindings

Objects that lose all assignments are revisited and retired. Deterministic RQ job IDs suppress overlapping active jobs.

Migration

0014_zabbixhostbinding

Dependencies

Stacks on PRs #115, #123, #124, #113. Merge last, after all dependencies.

Testing

• 80 focused zero-touch/lifecycle tests passed
• Full CI-isolated nbxSync suite: 1,128 tests passed
• makemigrations --check: no changes detected
• ruff format --check: all files formatted
• E2E verified against real Zabbix 7.0.28: create, second-sync reuse, rename, decommission, reactivate, hard delete, auto-sync via background scheduler, multi-level inheritance, assignment removal, exclusion

Part of #121.

[berlikm]

Commit history note

This PR currently shows 24 commits because it includes stacked commits from dependencies (#115, #113, #123, #124). Once the dependency PRs are merged into development, this branch will be rebased and squash-merged.

The actual durable-binding delta (after dependencies land) consists of ~7 commits:

1. feat(binding): durable ZabbixHostBinding for host identity — the core model + migration
2. fix(binding): reconcile hosts after assignment removal — candidate set union
3. fix(binding): preserve delete job compatibility — legacy instance-arg support
4. fix(binding): preserve legacy host ids on delete — capture unmigrated hostids
5. fix(binding): preserve legacy sync compatibility — getattr defaults
6. fix(exclusion): keep tag rendering contract — don't pass object to render()
7. fix(exclusion): retire delete-mapped hosts — excluded hosts still retire

Full verification on the integration branch (integration/all-prs): 1,128 tests pass, E2E confirmed against Zabbix 7.0.28.

[berlikm]

Conflict resolution note for rebase

When rebasing this PR after #110 and #115 land, there will be two conflicts in nbxsync/utils/sync/hostsync.py:

Conflict 1: host_binding import (line ~14)

• Ours (this PR): adds from nbxsync.utils.host_binding import backfill_or_resolve_conflict, delete_host_binding, delete_host_binding_by_id, get_host_binding, set_host_binding
• Theirs (Fix: Pass device context to tag render for Jinja2 values #110/Feature: Add Site, SiteGroup, and Region as assignment targets with inheritance #115): no host_binding import

Correct resolution: Take this PR's version (the import is needed for durable bindings).

Conflict 2: tag loop (line ~417)

• Ours (this PR): exclude_tag = getattr(self.pluginsettings, 'exclude_tag', '') + for assigned_tag in self.context.get('all_objects', {}).get('tags'): + value, _ = assigned_tag.render()
• Theirs (Feature: Add Site, SiteGroup, and Region as assignment targets with inheritance #115 + Fix: Pass device context to tag render for Jinja2 values #110): for assigned_tag in (self.context.get('all_objects', {}).get('tags', []) or []): + value, _ = assigned_tag.render(object=sync_target)

Correct resolution: Combine all three concerns:

exclude_tag = getattr(self.pluginsettings, 'exclude_tag', '')
for assigned_tag in (self.context.get('all_objects', {}).get('tags', []) or []):
    if exclude_tag and assigned_tag.zabbixtag.tag == exclude_tag:
        continue
    value, _ = assigned_tag.render(object=sync_target)

Important: The render(object=sync_target) call from #110 must be preserved. This PR's "keep tag rendering contract" commit reverted it to render(), but that was written before #110 was merged. With both PRs in the integration, render(object=sync_target) is the correct version — it renders Jinja2 tags against the actual device being synced, not the assignment's source object.

Migration

After rebasing, rename 0014_zabbixhostbinding.py to the next available number after the template-rule migrations (#117 → 0014, #119 → 0015). The #117 template-rule migration should depend on this binding migration to keep the chain linear: 0013 → 0014_zabbixhostbinding → 0015_zabbixtemplaterule → 0016_zabbixtemplaterule_hostgroup_tag.

Verified in the integration-test branch: 1135 tests pass, E2E confirmed (create, sync, verify hostgroups/tags, delete, verify Zabbix removal).