geenforce: the fleet table links where it says, and judges backups instead of dating them

Two fixes to the same table, in the same regions of the same files.

ASSET LINK POINTED AT THE WRONG RECORD. The Asset chip linked
/machines/<assetid>, but /machines/:id keys on machineid - the plugin extension
id - as MachineDetail itself does everywhere. So the link landed on whichever
machine happened to carry that number: a wrong page that looks right, which is
worse than a 404. Same for /measuringtools/. The API now returns
machinepluginid / toolpluginid beside the asset ids and the view links on those.
Both lookups are import-guarded, and with no plugin id the number renders as
plain text rather than a link that misleads. AssetRelationships already resolved
this correctly; this brings the reports table in line.

BACKUP COLUMN READ AS NEGLECT. It showed a raw date, and a revision is only
written when the config CHANGES - dedup means a machine stable for months has a
months-old newest revision and is perfectly healthy. The column already used
lastseenat, the last time the collector CONFIRMED the config, but a bare
timestamp says "nothing has happened since", which at the default 24h collection
interval IS the healthy steady state. It made a working system look stalled and
made the reader do arithmetic against a setting they would have to go and find.

It now returns backupok and shows a badge naming the kind, green when confirmed
recently, red when not, with the date and an explanation in the hover. backupok
is tri-state on purpose: null means no revision at all, and renders as NO badge
rather than a green one, because "never seen" must not read as healthy. The
threshold is the backups plugin's own backups_staledays, read through its
service so there is one definition of stale rather than a second drifting here.

Nothing in the badge is kind-specific, so a backup kind added later inherits it
by existing. docs/BACKUP-KINDS.md records that, the BackupKind contract, and why
the rule is time-based rather than per-kind.

plugins/geenforce/frontend/views/EnforcementReports.vue

@@ -61,23 +61,33 @@
                 <!-- What this PC IS or DRIVES, whichever applies. A part-marker
                      or bay PC shows its machine; a measuring-tool PC its tool;
                      a display its role. -->
-                <router-link v-if="report.machineassetid" class="asset-chip"
-                             :to="`/machines/${report.machineassetid}`"
+                <!-- /machines/:id and /measuringtools/:id key on the PLUGIN
+                     extension id, NOT the core assetid. Linking with the assetid
+                     lands on whichever record happens to share that number - a
+                     wrong page that looks right. No plugin id means the plugin
+                     is not installed or the asset has no extension row, so show
+                     the number as plain text rather than a link that misleads. -->
+                <router-link v-if="report.machinepluginid" class="asset-chip"
+                             :to="`/machines/${report.machinepluginid}`"
                              title="Machine this PC controls">
                   {{ report.machinenumber }}
                 </router-link>
-                <router-link v-if="report.toolassetid" class="asset-chip"
-                             :to="`/measuringtools/${report.toolassetid}`"
+                <span v-else-if="report.machinenumber" class="asset-chip muted"
+                      title="Machine this PC controls">{{ report.machinenumber }}</span>
+                <router-link v-if="report.toolpluginid" class="asset-chip"
+                             :to="`/measuringtools/${report.toolpluginid}`"
                              title="Measuring tool this PC controls">
                   {{ report.toolassetnumber }}
                 </router-link>
+                <span v-else-if="report.toolassetnumber" class="asset-chip muted"
+                      title="Measuring tool this PC controls">{{ report.toolassetnumber }}</span>
                 <span v-if="report.displayrole" class="asset-chip muted"
                       title="Display role">{{ report.displayrole }}</span>
                 <!-- Deliberately NOT the PC's own asset number: the collector
                      stores a PC's hostname AS its assetnumber, so echoing it
                      here would just repeat the Host column. Blank means this PC
                      drives nothing and is not a display. -->
-                <span v-if="!report.machineassetid && !report.toolassetid && !report.displayrole"
+                <span v-if="!report.machinenumber && !report.toolassetnumber && !report.displayrole"
                       class="muted">-</span>
                 <div v-if="report.location" class="asset-location muted">{{ report.location }}</div>
               </td>
@@ -99,15 +109,19 @@
               <td>{{ report.installed }}</td>
               <td class="muted">{{ report.skipped }}</td>
               <td :class="{ 'fail-count': report.failed }">{{ report.failed }}</td>
-              <!-- Last CONFIRMED, not last changed: an unchanged config writes
-                   no revision, so a stable machine is healthy with an old
-                   revision. What matters is whether the backup still runs. -->
-              <td class="muted">
-                <template v-if="report.backuplastseen">
-                  {{ formatDate(report.backuplastseen) }}
-                  <div class="backup-kind">{{ report.backupkind }}</div>
-                </template>
-                <span v-else>-</span>
+              <!-- A VERDICT, not a date. An unchanged config writes no new
+                   revision, so the timestamp is the last time the collector
+                   CHECKED and found the backup intact - which read as neglect
+                   when shown raw, because the healthy steady state is a
+                   day-old confirmation. The badge names the kind and colours
+                   it good/stale; the date moves to the tooltip. Any backup
+                   kind added later inherits this with no change here. -->
+              <td>
+                <span v-if="report.backupkind"
+                      class="badge"
+                      :class="backupClass(report)"
+                      :title="backupTitle(report)">{{ report.backupkind }}</span>
+                <span v-else class="muted">-</span>
               </td>
               <td class="muted">{{ formatDate(report.lastcheckin || report.receivedat) }}</td>
               <td class="actions">
@@ -191,6 +205,27 @@ function statusClass(status) {
   return { ok: 'badge-success', selfhealed: 'badge-info', failed: 'badge-danger' }[status] || ''
 }
 
+// null verdict = nothing to judge (no revision, or the check is disabled).
+// Deliberately NOT green: "never seen" must not read as healthy.
+function backupClass(report) {
+  if (report.backupok === true) return 'badge-success'
+  if (report.backupok === false) return 'badge-danger'
+  return ''
+}
+
+function backupTitle(report) {
+  const seen = report.backuplastseen ? formatDate(report.backuplastseen) : 'never'
+  if (report.backupok === true) {
+    return `${report.backupkind}: checked and verified ${seen}.`
+      + ' Config unchanged since, which is why the date does not move.'
+  }
+  if (report.backupok === false) {
+    return `${report.backupkind}: last confirmed ${seen}, more than`
+      + ` ${report.backupstaleafterdays} day(s) ago - the backup has stopped running.`
+  }
+  return `${report.backupkind}: last confirmed ${seen}.`
+}
+
 function staleTitle(report) {
   const received = report.receivedat ? formatDate(report.receivedat) : 'never'
   const checkin = report.lastcheckin ? formatDate(report.lastcheckin) : 'not reported'