feat(ansible): host provisioning via steward managed SSH identity

Turn the agent-install playbook into a full provisioning + maintenance
path. Solves the bootstrap chicken-and-egg: first contact uses an
operator-supplied password (one run, never stored), which creates a
dedicated `steward` login account with NOPASSWD sudo + Steward's managed
public key. Every run thereafter connects as `steward` with the managed
key — fully unattended (scheduled prune, agent updates).

- core/crypto: generate_ssh_keypair() — ed25519, OpenSSH formats.
- settings: ansible.ssh_public_key (non-secret, displayed) + ansible.ssh_user
  (default steward); to_ansible_cfg extended.
- settings UI + route: "Generate managed key" (private encrypted, public
  shown to copy) + SSH-user field.
- executor: build_bootstrap() writes a 0600 vars file (-e @file) for the
  per-run user/password — never argv, never DB, never logged; drops the
  managed key when a bootstrap password is given; --user floor from the
  global ssh_user when no override.
- runner.trigger_run: pass-through `connection` kwarg, deliberately NOT
  persisted on AnsibleRun.params (password stays out of the DB).
- bundled/host_agent/provision.yml: create steward user + authorized_keys
  + /etc/sudoers.d/steward (visudo-validated) + agent install.
- host_agent: /provision route + "Provision a fresh host" card (bootstrap
  user/password; injects pubkey + user + token as space-safe JSON hostvars).
- Dockerfile: add sshpass (Ansible shells out to it for password SSH).
- tests: keypair generation + build_bootstrap (secret stays off argv).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/ansible/bundled/host_agent/provision.yml

@@ -0,0 +1,143 @@
+---
+# First-contact provisioning: bring a fresh host under Steward management, then
+# install the host agent — all in one idempotent run.
+#
+# Run this ONCE per host with bootstrap credentials (an existing login + sudo,
+# typically password auth via the "Provision host" button). It:
+#   1. creates a dedicated `steward` login account,
+#   2. installs Steward's managed public key into its authorized_keys,
+#   3. grants it passwordless sudo,
+#   4. installs/updates the host agent.
+# After this, every future run (agent updates, maintenance) connects as
+# `steward` with the managed key — no operator credentials needed.
+#
+# Extra-vars (injected by the Provision card):
+#   steward_url, steward_token   — agent → Steward auth (per-host)
+#   steward_pubkey               — managed public key to authorize
+#   steward_user (default steward), agent_interval (default 30)
+- name: Provision host for Steward + install agent
+  hosts: all
+  become: true
+  gather_facts: false
+  vars:
+    steward_url: ""
+    steward_token: ""
+    steward_pubkey: ""
+    steward_user: steward
+    agent_interval: 30
+  tasks:
+    - name: Require provisioning vars
+      ansible.builtin.assert:
+        that:
+          - steward_url | length > 0
+          - steward_token | length > 0
+          - steward_pubkey | length > 0
+        fail_msg: "Pass steward_url, steward_token and steward_pubkey as extra-vars."
+
+    # ── Managed login account ────────────────────────────────────────────────
+    - name: Create the steward management account
+      ansible.builtin.user:
+        name: "{{ steward_user }}"
+        shell: /bin/sh
+        create_home: true
+        state: present
+
+    - name: Ensure ~/.ssh exists
+      ansible.builtin.file:
+        path: "/home/{{ steward_user }}/.ssh"
+        state: directory
+        owner: "{{ steward_user }}"
+        group: "{{ steward_user }}"
+        mode: "0700"
+
+    - name: Authorize the managed public key
+      ansible.builtin.lineinfile:
+        path: "/home/{{ steward_user }}/.ssh/authorized_keys"
+        line: "{{ steward_pubkey }}"
+        create: true
+        owner: "{{ steward_user }}"
+        group: "{{ steward_user }}"
+        mode: "0600"
+
+    - name: Grant passwordless sudo to the steward account
+      ansible.builtin.copy:
+        dest: "/etc/sudoers.d/steward"
+        content: "{{ steward_user }} ALL=(ALL) NOPASSWD:ALL\n"
+        owner: root
+        group: root
+        mode: "0440"
+        validate: "visudo -cf %s"
+
+    # ── Host agent (same as install.yml) ─────────────────────────────────────
+    - name: Create steward-agent system user
+      ansible.builtin.user:
+        name: steward-agent
+        system: true
+        shell: /usr/sbin/nologin
+        create_home: false
+
+    - name: Create agent directory
+      ansible.builtin.file:
+        path: /usr/local/lib/steward-agent
+        state: directory
+        mode: "0755"
+
+    - name: Download agent.py
+      ansible.builtin.get_url:
+        url: "{{ steward_url }}/plugins/host_agent/agent.py"
+        dest: /usr/local/lib/steward-agent/agent.py
+        mode: "0755"
+        force: true
+      notify: restart steward-agent
+
+    - name: Write agent config
+      ansible.builtin.copy:
+        dest: /etc/steward-agent.conf
+        owner: root
+        group: steward-agent
+        mode: "0640"
+        content: |
+          url = {{ steward_url }}
+          token = {{ steward_token }}
+          interval_seconds = {{ agent_interval }}
+      notify: restart steward-agent
+
+    - name: Install systemd unit
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/steward-agent.service
+        mode: "0644"
+        content: |
+          [Unit]
+          Description=Steward host agent
+          After=network-online.target
+          Wants=network-online.target
+
+          [Service]
+          Type=simple
+          User=steward-agent
+          Environment=STEWARD_AGENT_CONFIG=/etc/steward-agent.conf
+          ExecStart=/usr/bin/env python3 /usr/local/lib/steward-agent/agent.py
+          Restart=on-failure
+          RestartSec=5
+          NoNewPrivileges=true
+          ProtectSystem=strict
+          ProtectHome=true
+          PrivateTmp=true
+
+          [Install]
+          WantedBy=multi-user.target
+      notify: restart steward-agent
+
+    - name: Enable and start the agent
+      ansible.builtin.systemd:
+        name: steward-agent
+        enabled: true
+        state: started
+        daemon_reload: true
+
+  handlers:
+    - name: restart steward-agent
+      ansible.builtin.systemd:
+        name: steward-agent
+        state: restarted
+        daemon_reload: true