feat(ansible): credentials — SSH key, become, vault, host-key checking (task 548)

Global Ansible credentials, applied to every run (manual + alert-triggered):
- core/settings.py: ansible.ssh_private_key / become_password / vault_password
  (plaintext at rest, masked in UI — encryption tracked in #580) + host_key_checking
  (default off); surfaced via to_ansible_cfg into app.config[ANSIBLE]
- executor.py: pure build_credentials() materializes creds into a 0600 temp dir
  (--private-key, --vault-password-file, become via -e @vars-file so the password
  never hits argv) cleaned up in finally; pure ansible_env() sets
  ANSIBLE_HOST_KEY_CHECKING. build_ansible_command stays param-only
- settings/routes.py + ansible.html: admin-only Credentials section, masked-update
  (blank keeps current, explicit Clear checkbox), reload app config on save
- tests: unit (build_credentials per cred + none; ansible_env toggle); integration
  vault round-trip (ansible-vault encrypt a vars file, run via executor with the
  vault password, assert it decrypted)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/core/settings.py

@@ -51,6 +51,12 @@ DEFAULTS: dict[str, Any] = {
     "webhook.url": "",
     "webhook.template": _DEFAULT_WEBHOOK_TEMPLATE,
     "ansible.sources": [],
+    # Ansible credentials — global, used by every run (manual + alert-triggered).
+    # Plaintext at rest, masked in the UI (encryption-at-rest tracked separately).
+    "ansible.ssh_private_key": "",
+    "ansible.become_password": "",
+    "ansible.vault_password": "",
+    "ansible.host_key_checking": False,
     "ping.threshold.good_ms": 50,
     "ping.threshold.warn_ms": 200,
     "plugins.index_url": "https://git.fabledsword.com/bvandeusen/Steward-plugins/raw/branch/main/index.yaml",
@@ -152,7 +158,13 @@ def to_webhook_cfg(settings: dict[str, Any]) -> dict:
 
 
 def to_ansible_cfg(settings: dict[str, Any]) -> dict:
-    return {"sources": settings.get("ansible.sources", [])}
+    return {
+        "sources": settings.get("ansible.sources", []),
+        "ssh_private_key": settings.get("ansible.ssh_private_key", ""),
+        "become_password": settings.get("ansible.become_password", ""),
+        "vault_password": settings.get("ansible.vault_password", ""),
+        "host_key_checking": settings.get("ansible.host_key_checking", False),
+    }
 
 
 def to_oidc_cfg(settings: dict[str, Any]) -> dict: