feat(ansible): credentials — SSH key, become, vault, host-key checking (task 548)

Global Ansible credentials, applied to every run (manual + alert-triggered):
- core/settings.py: ansible.ssh_private_key / become_password / vault_password
  (plaintext at rest, masked in UI — encryption tracked in #580) + host_key_checking
  (default off); surfaced via to_ansible_cfg into app.config[ANSIBLE]
- executor.py: pure build_credentials() materializes creds into a 0600 temp dir
  (--private-key, --vault-password-file, become via -e @vars-file so the password
  never hits argv) cleaned up in finally; pure ansible_env() sets
  ANSIBLE_HOST_KEY_CHECKING. build_ansible_command stays param-only
- settings/routes.py + ansible.html: admin-only Credentials section, masked-update
  (blank keeps current, explicit Clear checkbox), reload app config on save
- tests: unit (build_credentials per cred + none; ansible_env toggle); integration
  vault round-trip (ansible-vault encrypt a vars file, run via executor with the
  vault password, assert it decrypted)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/ansible/executor.py

@@ -1,7 +1,11 @@
 # steward/ansible/executor.py
 from __future__ import annotations
 import asyncio
+import json
 import logging
+import os
+import shutil
+import tempfile
 import time
 from dataclasses import dataclass
 from datetime import datetime, timezone
@@ -83,6 +87,46 @@ def build_ansible_command(
     return cmd
 
 
+def build_credentials(creds: dict | None, tmpdir: str) -> tuple[list[str], list[tuple[str, str]]]:
+    """Given global Ansible creds + a temp dir, return (extra argv, files to write).
+
+    Pure: decides flags + file contents; the caller writes the files (mode 0600).
+    Secrets are always passed via files — never on argv / the process list.
+    creds keys: ssh_private_key, vault_password, become_password.
+    """
+    args: list[str] = []
+    files: list[tuple[str, str]] = []
+    creds = creds or {}
+
+    key = creds.get("ssh_private_key")
+    if key:
+        path = os.path.join(tmpdir, "id_key")
+        files.append((path, key if key.endswith("\n") else key + "\n"))
+        args += ["--private-key", path]
+
+    vault = creds.get("vault_password")
+    if vault:
+        path = os.path.join(tmpdir, "vault_pass")
+        files.append((path, vault + "\n"))
+        args += ["--vault-password-file", path]
+
+    become = creds.get("become_password")
+    if become:
+        path = os.path.join(tmpdir, "become.yml")
+        # A JSON string is valid YAML; keeps the password out of argv.
+        files.append((path, "ansible_become_password: " + json.dumps(become) + "\n"))
+        args += ["-e", "@" + path]
+
+    return args, files
+
+
+def ansible_env(creds: dict | None, base_env) -> dict:
+    """Return a copy of base_env with ANSIBLE_HOST_KEY_CHECKING set from creds."""
+    env = dict(base_env)
+    env["ANSIBLE_HOST_KEY_CHECKING"] = "True" if (creds or {}).get("host_key_checking") else "False"
+    return env
+
+
 async def start_run(
     app: "Quart",
     run_id: str,
@@ -119,13 +163,24 @@ async def start_run(
 
     cmd = build_ansible_command(playbook_path, inventory_path, params)
     cwd = source_path if Path(source_path).exists() else None
+    creds = app.config.get("ANSIBLE", {})
 
+    # Materialize credentials into a private temp dir; removed in finally.
+    tmpdir = tempfile.mkdtemp(prefix="steward-ansible-")
+    os.chmod(tmpdir, 0o700)
     try:
+        cred_args, cred_files = build_credentials(creds, tmpdir)
+        for cred_path, content in cred_files:
+            with open(cred_path, "w", encoding="utf-8") as cf:
+                cf.write(content)
+            os.chmod(cred_path, 0o600)
+
         proc = await asyncio.create_subprocess_exec(
-            *cmd,
+            *cmd, *cred_args,
             stdout=asyncio.subprocess.PIPE,
             stderr=asyncio.subprocess.STDOUT,
             cwd=cwd,
+            env=ansible_env(creds, os.environ),
         )
         assert proc.stdout is not None
 
@@ -152,6 +207,8 @@ async def start_run(
     except Exception:
         logger.exception("Ansible run %s failed with exception", run_id)
         final_status = "failed"
+    finally:
+        shutil.rmtree(tmpdir, ignore_errors=True)
 
     await _flush(final_status)
     _broadcast(run_id, _Done(status=final_status))