feat(ansible): run a playbook against a single Steward host (task 547)

From a host's edit page, an operator can run a playbook against just that host
via an ephemeral one-host inventory — no need for the host to exist in a source
inventory.

- ansible/sources.py: pure host_inventory_content(host) -> '<name> ansible_host=<addr>'
- executor.start_run: optional inventory_content written to the temp dir and used
  as -i (overrides inventory_path); cleaned up with the creds dir
- hosts/routes.py: POST /hosts/<id>/run-playbook (operator) — validates source +
  playbook, builds the ephemeral inventory, starts a user-triggered run, redirects
  to the live run detail; edit page gets the ansible source list
- hosts/form.html: 'Run Ansible playbook against this host' panel (shown when
  editing an existing host and sources exist) — source + playbook + extra-vars/
  tags/dry-run (no --limit; single host)
- tests: unit host_inventory_content; integration runs a hosts:all/connection:local
  playbook against the ephemeral inventory and asserts inventory_hostname

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/integration/test_host_targeted_run.py

@@ -0,0 +1,66 @@
+"""Integration: a host-targeted run uses the ephemeral one-host inventory (task 547).
+
+Runs a `hosts: all` / `connection: local` playbook through executor.start_run with
+an ephemeral inventory built from a Host, and asserts the play executed against
+that host's inventory_hostname — proving the inventory_content plumbing.
+"""
+from __future__ import annotations
+
+import asyncio
+import os
+import textwrap
+import uuid
+
+import pytest
+
+pytestmark = pytest.mark.integration
+
+_NEEDS_DB = pytest.mark.skipif(
+    not os.environ.get("STEWARD_DATABASE_URL"),
+    reason="integration test needs a live Postgres (STEWARD_DATABASE_URL)",
+)
+
+
+@pytest.fixture
+def app():
+    if not os.environ.get("STEWARD_DATABASE_URL"):
+        pytest.skip("needs Postgres")
+    from steward.app import create_app
+    return create_app(testing=False)
+
+
+@_NEEDS_DB
+def test_ephemeral_inventory_targets_host(app, tmp_path):
+    from sqlalchemy import select
+    from steward.ansible import executor, sources
+    from steward.models.ansible import AnsibleRun, AnsibleRunStatus
+    from steward.models.hosts import Host
+
+    (tmp_path / "play.yml").write_text(textwrap.dedent("""\
+        - hosts: all
+          connection: local
+          gather_facts: false
+          tasks:
+            - debug:
+                msg: "HOST-{{ inventory_hostname }}"
+    """))
+    inv_content = sources.host_inventory_content(Host(name="demo-host", address="127.0.0.1"))
+
+    run_id = str(uuid.uuid4())
+
+    async def _go():
+        async with app.db_sessionmaker() as s:
+            async with s.begin():
+                s.add(AnsibleRun(
+                    id=run_id, playbook_path="play.yml", inventory_path="host: demo-host",
+                    source_name="t", triggered_by=None, status=AnsibleRunStatus.running,
+                ))
+        await executor.start_run(
+            app, run_id, "play.yml", "host: demo-host", str(tmp_path), None, inv_content)
+        async with app.db_sessionmaker() as s:
+            return (await s.execute(
+                select(AnsibleRun).where(AnsibleRun.id == run_id))).scalar_one()
+
+    run = asyncio.run(_go())
+    assert run.status == AnsibleRunStatus.success, run.output
+    assert "HOST-demo-host" in (run.output or "")  # ran against the ephemeral inventory host