feat(ansible): run a playbook against a single Steward host (task 547)

From a host's edit page, an operator can run a playbook against just that host
via an ephemeral one-host inventory — no need for the host to exist in a source
inventory.

- ansible/sources.py: pure host_inventory_content(host) -> '<name> ansible_host=<addr>'
- executor.start_run: optional inventory_content written to the temp dir and used
  as -i (overrides inventory_path); cleaned up with the creds dir
- hosts/routes.py: POST /hosts/<id>/run-playbook (operator) — validates source +
  playbook, builds the ephemeral inventory, starts a user-triggered run, redirects
  to the live run detail; edit page gets the ansible source list
- hosts/form.html: 'Run Ansible playbook against this host' panel (shown when
  editing an existing host and sources exist) — source + playbook + extra-vars/
  tags/dry-run (no --limit; single host)
- tests: unit host_inventory_content; integration runs a hosts:all/connection:local
  playbook against the ephemeral inventory and asserts inventory_hostname

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_host_inventory.py

@@ -0,0 +1,13 @@
+"""Unit tests for the ephemeral one-host inventory helper (task 547)."""
+from steward.ansible.sources import host_inventory_content
+from steward.models.hosts import Host
+
+
+def test_with_address_sets_ansible_host():
+    inv = host_inventory_content(Host(name="web1", address="10.0.0.5"))
+    assert inv == "web1 ansible_host=10.0.0.5\n"
+
+
+def test_without_address_falls_back_to_name():
+    inv = host_inventory_content(Host(name="web1", address=""))
+    assert inv == "web1\n"