feat: Site/SiteGroup/Region inheritance, recursive ancestry, exclusion and inherited sync UI

[berlikm]

Summary

Site / SiteGroup / Region inheritance for zero-touch provisioning (#121).

Rebased onto 1.0.5 development (36fb2c4). This PR no longer conflicts with the 1.0.5 line (trigger-dependency sync, NetBox v4.6.7 CI pin, gettext_lazy, template-pattern extraction).

Includes (supersedes): #113, #114, #116, #124
Not in this PR: TemplateRule (#117), render (#110), lifecycle (#125), OOB (#129)

Highlights

• Hierarchy assignment targets + recursive ancestry
• NetBox Tag as an assignment target (including host interfaces)
• exclude_tag (default empty / disabled); inherited sync status UI; ConfigGroup site form
• Migrations 0013 (hierarchy targets) and 0014 (Tag + host-interface Tag targets)
• Default chain keeps role/platform ahead of site hierarchy; cluster site via cluster._site

1.0.5 already requires NetBox ≥4.2.6 (PluginConfig.min_version); this PR does not change that.

Trigger-dependency sync from 1.0.5 is kept disabled by default and runs once after the host assignment loop.

Scope frozen at tip 993e05b — review against that SHA.

Merge after: #122
Next: #117

[berlikm]

This PR is part of the zero-touch provisioning feature set described in #121. Please see that issue for the full architecture and motivation.

[berlikm]

Summary

Consolidates the hierarchy / site-mapping slice of #121 into one reviewable PR:

Included	Was
Site / SiteGroup / Region assignment targets + inheritance	#115
ConfigGroupAssignment form for Site/SiteGroup/Region	#116
Recursive SiteGroup / Region / DeviceRole ancestry + batched resolution	#124 (supersedes closed #112)
Tag-based host exclusion (exclude_tag)	#113
Neutral UI indicator for inherited sync status	#114

Not in this PR (kept separate on purpose): template rules (#117–#119), device-context rendering (#110/#111/#130), durable host bindings / zero-touch lifecycle (#123/#125), CI trigger (#122), create-race (#127), OOB IP (#129).

Base: development. Single migration leaf 0013 (includes dcim.region as a real assignment target).

Why consolidate these

They are one feature for a reviewer: policy at Site/SiteGroup/Region, inheritance walk, exclusion, and the UI that makes inherited rows understandable. Splitting them forced a brittle review order and hid integration issues. Other #121 themes stay in their own PRs per docs/development.md (focused branches).

Fix on top of the original stack

Forms/docs already offered Region, but ASSIGNMENT_MODELS / migration state omitted it. Host inventory and configuration-group assignments now accept the same hierarchy targets their forms expose.

Verification

• makemigrations --check — clean
• Focused suite (inheritance recursive, assigned objects, exclusion, syncbase, synchost) — 73 tests OK

Follow-ups

Please close #113, #114, #116, #124 as superseded by this PR (commits preserved with authorship). Remaining #121 PRs stay open for separate review.

[berlikm]

Added: NetBox Tags as assignment targets (commits d02bc86, 64a85e1 + docs).

Any assignment (hostgroup, template, tag, macro, server, inventory, config group) can now be pointed at an extras.Tag. Devices/VMs/VDCs carrying the tag inherit it at object level; membership appears/disappears automatically when tags change (no per-object rows to maintain). Sources are labeled Tag: <name> in previews. Motivation: tag-driven classes like a critical-tag → Priority/Critical hostgroup mapping were previously per-device bookkeeping.

Implementation: one Q-line in ASSIGNMENT_MODELS, attribute-level triples collected before the hierarchy chain in the batched resolver, makemigrations-generated state-only AlterField migration, 7 tests covering lifecycle/labels/VMs/server scoping. Verified live on NetBox 4.5.10 + Zabbix 7.0.28: tag a switch → group joins after sync; untag → leaves.

[berlikm]

Rebased this onto current 1.0.5 development (36fb2c4). GitHub now reports it merge-clean.

Required conflict resolutions vs 1.0.5:

• Kept Site/SiteGroup/Region/Tag assignment targets, recursive ancestry, exclude_tag (default empty / off), and migrations 0013/0014.
• Took 1.0.5's template-pattern extraction, gettext_lazy, and CI pin to NetBox v4.6.7.
• Dropped forward-leaks from later PRs that had landed on the old frozen tip (ZabbixTemplateRule / use_oob_ip references). Those belong in feat: ZabbixTemplateRule regex template assignment (with hostgroup/tag and API) #117 and feat(use_oob_ip): vendor-agnostic out-of-band interface IP resolution #129; this PR has to import and boot on its own.
• constants/__init__.py does not re-export assignment_type_to_field (circular import with models).

Trigger dependencies (from 1.0.5 / #100): kept as-is from 1.0.5. trigger_dependencies.enabled stays False by default. When an operator turns it on, the hook runs once after the host assignment loop — not per server assignment, and not on excluded hosts, VMs, or DELETED status. This PR does not enable or expand that feature.

Scope frozen at 993e05b. Merge after #122; next is #117.