Test toolchain and CI housekeeping

[somethingwithproof]

Housekeeping found while reviewing #345. None of these affect a running install.

1. Removing composer.json orphans the Pest suite

#345 drops composer.json and composer.lock per the "no composer.json in plugin directories" rule, which is correct for the runtime dependency. But require-dev carried pestphp/pest, phpunit/phpunit and vimeo/psalm, and these are left with no installable runner:

• phpunit.xml.dist, bootstrapping tests/Pest.php
• tests/Pest.php, which calls uses(), a Pest-only function
• tests/Pest/{Unit,Integration,E2E}/*Test.php and tests/Security/*Test.php

Either drop the Pest tree in favour of the plain PHP scripts under tests/Unit and tests/Integration, which run with no dependencies, or document a globally installed runner.

2. shivammathur/setup-php@v2 is pinned to a mutable tag

.github/workflows/code-quality.yml lines 39, 63 and 95. actions/checkout is correctly pinned to a full SHA in all four places. A tag repoint on a third-party action gives it write access to the job.

3. mactrack_ajax.php is a dead endpoint still registered in two realms

After the graph-settings action was removed, the file is:

set_default_action();
switch (get_request_var('action')) {
	default:
		break;
}

setup.php:45 and setup.php:134 still list it in the Mactrack Viewer realm. Delete the file and drop it from both realm strings, or say why the shell is kept.

4. Stale phpstan-baseline.neon entries

Function mactrack_save_graph_settings not found (line 2974) and Function format_mac_address not found (line 4354) both describe errors that no longer exist. Harmless only because .phpstan.neon:44 sets reportUnmatchedIgnoredErrors: false.

5. tests/Security/Php74CompatibilityTest.php is stale and near-vacuous

It enforces a PHP 7.4 floor over a hardcoded ten-file list that includes mactrack_interfaces.php, a path that does not exist. The real file is mactrack_view_interfaces.php, and the test skips missing paths silently.

6. Version claims disagree

INFO says compat = 1.2.14. README.md says Cacti 1.2.31 or later and PHP 8.1 or greater, "matching the floor Cacti 1.2 itself requires". Cacti 1.2.31's own composer.json says >=8.0. Pick one and make the three agree.

7. Nothing in CI runs tests/

.github/workflows/*.yml never invokes the test directory. The standalone scripts under tests/Unit, tests/Integration and tests/e2e need no dependencies and could run on every push.