feat(ansible): run a playbook against a single Steward host (task 547)

From a host's edit page, an operator can run a playbook against just that host
via an ephemeral one-host inventory — no need for the host to exist in a source
inventory.

- ansible/sources.py: pure host_inventory_content(host) -> '<name> ansible_host=<addr>'
- executor.start_run: optional inventory_content written to the temp dir and used
  as -i (overrides inventory_path); cleaned up with the creds dir
- hosts/routes.py: POST /hosts/<id>/run-playbook (operator) — validates source +
  playbook, builds the ephemeral inventory, starts a user-triggered run, redirects
  to the live run detail; edit page gets the ansible source list
- hosts/form.html: 'Run Ansible playbook against this host' panel (shown when
  editing an existing host and sources exist) — source + playbook + extra-vars/
  tags/dry-run (no --limit; single host)
- tests: unit host_inventory_content; integration runs a hosts:all/connection:local
  playbook against the ephemeral inventory and asserts inventory_hostname

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/ansible/sources.py

@@ -72,6 +72,18 @@ def discover_inventories(source_path: str) -> list[str]:
     return sorted(name for name in INVENTORY_NAMES if (root / name).exists())
 
 
+def host_inventory_content(host) -> str:
+    """An ephemeral single-host inventory line for a Steward Host.
+
+    Targets the host's address when set (`ansible_host=`), else just the name
+    (resolved via DNS). Playbooks run against this should use `hosts: all` (or
+    the host's name). Pure — `host` only needs `.name` and `.address`.
+    """
+    if getattr(host, "address", ""):
+        return f"{host.name} ansible_host={host.address}\n"
+    return f"{host.name}\n"
+
+
 def read_playbook(source_path: str, relative_path: str) -> str | None:
     """Return contents of a playbook file, or None if not found / path escape."""
     root = Path(source_path).resolve()