Cover the installer's connection check, the import, and two link paths

[blaipr]

What

Tests across five controllers, salvaged and finished from an agent run that stopped part-way.

The installer's connection check

The first thing anybody runs, and the only feedback they get about credentials that do not work:

• an empty host and a unix socket path that is not there are each reported;
• a database that cannot be reached is reported as an error the wizard can display;
• once the attempt limit is hit, the refusal comes before any connection is tried.

The throttle writes to a real directory, keyed on random bytes rather than faker — the harness seeds faker, so two tests in the same class drew the same name and the second mkdir warned.

The import, and two save controllers

What the import refuses and what it reports when the import itself fails part-way; the account-configuration and custom-field-create refusals.

Two public link paths

• A valid link renders its password as an image when the instance is configured that way.
• The audit event a valid link records has its viewer address masked on a demo instance.

One thing pinned deliberately rather than approvingly

A hash that was never issued answers with the bare string Link not found, while a real but expired link answers with the permission-denied page — the exception for an unknown hash escapes to the generic handler, which renders it through the action's plain-text type. So the two are distinguishable from outside, on a page reachable without signing in.

Public link hashes are long random strings, so this is an oracle nobody can practically walk — it tells an attacker who already holds a hash that it was once real. It is written down in the test rather than left to be rediscovered, and it is worth a decision separately from this PR.

Testing

Integration: 30 green across the four classes. Unit: 2 green on the custom-field controller.