feat(ansible): credentials — SSH key, become, vault, host-key checking (task 548)

Global Ansible credentials, applied to every run (manual + alert-triggered):
- core/settings.py: ansible.ssh_private_key / become_password / vault_password
  (plaintext at rest, masked in UI — encryption tracked in #580) + host_key_checking
  (default off); surfaced via to_ansible_cfg into app.config[ANSIBLE]
- executor.py: pure build_credentials() materializes creds into a 0600 temp dir
  (--private-key, --vault-password-file, become via -e @vars-file so the password
  never hits argv) cleaned up in finally; pure ansible_env() sets
  ANSIBLE_HOST_KEY_CHECKING. build_ansible_command stays param-only
- settings/routes.py + ansible.html: admin-only Credentials section, masked-update
  (blank keeps current, explicit Clear checkbox), reload app config on save
- tests: unit (build_credentials per cred + none; ansible_env toggle); integration
  vault round-trip (ansible-vault encrypt a vars file, run via executor with the
  vault password, assert it decrypted)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/templates/settings/ansible.html

@@ -15,5 +15,53 @@
     cloned automatically. Add as many as you need; each can be browsed and run independently.
   </p>
   {% include "settings/_ansible_sources.html" %}
+
+  {# ── Credentials ──────────────────────────────────────────────────────────── #}
+  {% set cfg_badge = '<span style="color:var(--green);font-size:0.72rem;">(configured)</span>' %}
+  {% set not_set_badge = '<span style="color:var(--text-muted);font-size:0.72rem;">(not set)</span>' %}
+  <div style="margin-top:2.25rem;">
+    <div class="section-title" style="margin-bottom:0.75rem;">Credentials</div>
+    <p style="color:var(--text-muted);font-size:0.84rem;margin-bottom:1rem;">
+      Used by every playbook run (manual and alert-triggered). Stored on the server and
+      never shown again after saving — leave a field blank to keep the current value.
+    </p>
+    <form method="post" action="/settings/ansible/credentials">
+      <div class="form-group">
+        <label>SSH private key {{ (cfg_badge if ssh_key_set else not_set_badge) | safe }}</label>
+        <textarea name="ssh_private_key" rows="4"
+                  placeholder="-----BEGIN OPENSSH PRIVATE KEY----- …  (blank = keep current)"
+                  style="width:100%;font-family:ui-monospace,monospace;font-size:0.8rem;"></textarea>
+        {% if ssh_key_set %}
+        <label style="font-weight:normal;font-size:0.8rem;color:var(--text-muted);">
+          <input type="checkbox" name="clear_ssh_private_key"> Clear stored key</label>
+        {% endif %}
+      </div>
+      <div class="form-group">
+        <label>Become / sudo password {{ (cfg_badge if become_set else not_set_badge) | safe }}</label>
+        <input type="password" name="become_password" autocomplete="new-password"
+               placeholder="blank = keep current">
+        {% if become_set %}
+        <label style="font-weight:normal;font-size:0.8rem;color:var(--text-muted);">
+          <input type="checkbox" name="clear_become_password"> Clear</label>
+        {% endif %}
+      </div>
+      <div class="form-group">
+        <label>Vault password {{ (cfg_badge if vault_set else not_set_badge) | safe }}</label>
+        <input type="password" name="vault_password" autocomplete="new-password"
+               placeholder="blank = keep current">
+        {% if vault_set %}
+        <label style="font-weight:normal;font-size:0.8rem;color:var(--text-muted);">
+          <input type="checkbox" name="clear_vault_password"> Clear</label>
+        {% endif %}
+      </div>
+      <div class="form-group">
+        <label style="display:flex;align-items:center;gap:0.5rem;font-weight:normal;">
+          <input type="checkbox" name="host_key_checking" {% if host_key_checking %}checked{% endif %}>
+          Enforce SSH host-key checking <span style="color:var(--text-muted);font-size:0.78rem;">(off by default for homelab convenience)</span>
+        </label>
+      </div>
+      <button type="submit" class="btn">Save credentials</button>
+    </form>
+  </div>
 </div>
 {% endblock %}