refactor: centralize report filter and export plumbing

[somethingwithproof]

Problem

MacTrack's report pages independently implement the same request-validation, session-filter, SQL-filter, export, and list-rendering pipeline. The duplication makes security and compatibility fixes easy to apply to one report while missing another.

Current evidence on develop:

• seven mactrack_view_*.php pages call validate_store_request_vars()
• eight report-page validation functions implement overlapping request rules
• mactrack_view_arp.php and mactrack_view_ips.php both declare mactrack_view_ips_validate_request_vars(), so the scripts cannot safely share a process
• the report pages repeat site/device/status filter construction, pagination, export queries, and option-label escaping

This is a focused implementation item under #304. It is architectural follow-up, not a MacTrack/Cacti 1.2 release blocker.

Proposed direction

• define report filters declaratively in one shared helper or service
• centralize request normalization, session persistence, SQL predicate/parameter construction, pagination, and CSV export selection
• give each endpoint a unique public entry function and keep page-specific columns/rendering local
• migrate one report at a time so behavior changes and broad formatting churn are avoided

Acceptance criteria

• shared code owns the common request/filter/session pipeline
• prepared SQL parameters and output escaping remain context-correct
• all report entry functions have unique names
• existing URLs, session keys, filters, pagination, and CSV output remain backward compatible
• unit tests cover filter definitions and SQL parameter construction
• Docker integration tests cover at least MAC, ARP/IP, device, site, and interface reports
• no increase to the raw or dynamically-built SQL debt ratchets

Related to #304 and #315.