feat(timeline): record a change by hand from the Timeline, a host's page or MCP log_change (#6350)

A change Steward can't see happen (a config edited, a disk swapped) is
recorded by whoever made it: what was done, its area, when (in the reader's
own zone), the hosts, what it was done to and a detail. Its author or an
admin edits or deletes it; recording, editing and deleting are audited and
those audit rows stay off the timeline. log_change records one as
"<user> via MCP", editable by the token's user.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/audit/service.py

@@ -94,6 +94,12 @@ async def entity_labels(db, items: list[dict]) -> dict[tuple[str, str], dict]:
                 labels[(etype, r.id)] = {
                     "label": run_title(r.playbook_path, scopes.get(r.inventory_scope, r.inventory_scope)),
                     "url": f"/ansible/runs/{r.id}", "gone": False}
+        elif etype == "timeline_entry":
+            from steward.models.timeline import TimelineEntry
+            for row_id, summary in (await db.execute(
+                    select(TimelineEntry.id, TimelineEntry.summary)
+                    .where(TimelineEntry.id.in_(list(wanted))))).all():
+                labels[(etype, row_id)] = {"label": summary, "url": None, "gone": False}
         elif etype in _SELF_NAMED:
             for i in wanted:
                 labels[(etype, i)] = {"label": i, "url": _SELF_NAMED[etype], "gone": False}
@@ -206,6 +212,9 @@ ACTIONS = {
     "syslog.pattern_added": "added syslog pattern",
     "syslog.pattern_updated": "changed syslog pattern",
     "syslog.pattern_removed": "removed syslog pattern",
+    "timeline.change_recorded": "recorded a change:",
+    "timeline.change_edited": "edited the recorded change",
+    "timeline.change_deleted": "deleted the recorded change",
     "backup.made": "sent a backup",
     "backup.failed": "tried to send a backup, which failed:",
     "backup.restored": "restored Steward from a backup",
@@ -218,7 +227,7 @@ AREAS = (("auth.", "Sign-ins"), ("account.", "Accounts"), ("user.", "Users"), ("
          ("ansible.run", "Playbook runs"), ("ansible.", "Ansible (all)"),
          ("settings.", "Settings"), ("plugin.", "Plugins"), ("api_token.", "AI access"),
          ("docker.", "Docker"), ("snmp.", "SNMP"), ("prometheus.", "Prometheus"),
-         ("syslog.", "Syslog"), ("backup.", "Backups"))
+         ("syslog.", "Syslog"), ("backup.", "Backups"), ("timeline.", "Timeline"))
 
 
 def action_text(action: str) -> str: