[2.x] fix(api): guard EloquentBuffer against orphaned/mock models

[imorland]

Summary

• Filter models with exists=false (or a null key) out of the collection passed to load()/loadAggregate() in EloquentBuffer::load(), and always clear the buffer entry so stale mocks don't accumulate.

Background

Closes #4667.

Laravel's Illuminate\Database\Eloquent\Collection::loadAggregate() (see Collection.php:127) reads attributes off the per-key result map without a null check:

$extraAttributes = Arr::only($models->get($model->getKey())->getAttributes(), $attributes);

If a model in the source collection has a key that doesn't match any DB row, $models->get(...) is null and the request fatals with Call to a member function getAttributes() on null.

The JSON:API BelongsTo linkage shortcut in EloquentResource::getRelationshipValue() (vendor/flarum/json-api-server) and the mirror in our AbstractDatabaseResource::getRelationshipValue() create exactly this kind of mock model:

return $related->newInstance()->forceFill([$related->getKeyName() => $key]);

When such a mock ends up in EloquentBuffer for a relationAggregate field (e.g. fof/upload's countRelation('foffiles') on UserResource), the flush at the end of the request crashes the whole response with a 500 — affecting any page that serializes that resource (including the forum index for guests).

Fix

In EloquentBuffer::load():

• Filter the buffered models down to those that actually exist and have a non-null key before constructing the collection that gets passed to load() / loadAggregate().
• Clear the buffer entry unconditionally (moved above the early return) so the same stale mocks aren't re-walked on subsequent loads.

Test plan

• New regression test EloquentBufferTest::aggregate_load_does_not_crash_for_models_that_do_not_exist_in_the_database — fails on 2.x with the exact stack from the issue, passes with this fix.
• tests/integration/extenders/ApiResourceTest.php — 41/41 pass.
• tests/integration/api/discussions/ — 39/39 pass.
• tests/integration/api/users/ + tests/integration/api/posts/ — 136/136 pass.