feat(ansible): scheduled recurring playbook runs

Adds cron-like recurring runs (the engine the maintenance-automation work
needs). New AnsibleSchedule model + migration 0018; a core ScheduledTask
(ansible_scheduled_runs, 60s) fires due schedules, each creating a
system-triggered AnsibleRun (triggered_by=None). Centralises the
resolve-inventory → create-run → launch flow in ansible/runner.trigger_run,
shared by the manual route (refactored to use it) and the scheduler.

Schedules UI under /ansible/schedules: create/edit/pause/delete/run-now,
with interval presets, scope targeting (all / group / target), extra-vars /
limit / tags / dry-run, and last-run status (resolved via last_run_id) +
next-run. Unit test for the due-check.

Task #549 (milestone #37).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/ansible/runner.py

@@ -0,0 +1,78 @@
+# steward/ansible/runner.py
+"""Shared playbook-run launcher used by the manual route, alerts, and schedules.
+
+Centralises the resolve-inventory → create AnsibleRun → launch executor flow so
+manual, alert-triggered, and scheduled runs all take the exact same path.
+"""
+from __future__ import annotations
+
+import asyncio
+import json
+import uuid
+from datetime import datetime, timezone
+
+from steward.ansible import executor, sources as src_module
+from steward.ansible.inventory_gen import fetch_scope_targets, generate_inventory
+from steward.models.ansible import AnsibleRun, AnsibleRunStatus
+
+
+async def trigger_run(
+    app,
+    *,
+    source_name: str,
+    playbook_path: str,
+    inventory_scope: str = "steward:all",
+    params: dict | None = None,
+    triggered_by: str | None = None,
+):
+    """Resolve inventory for the scope, persist an AnsibleRun, and launch it.
+
+    triggered_by=None marks a system/automated run (alerts, schedules).
+    Returns (run, source, error): on success error is None; on failure run is
+    None and error is a short human-readable reason.
+    """
+    sources = src_module.get_sources(app.config.get("ANSIBLE", {}))
+    source = next((s for s in sources if s["name"] == source_name), None)
+    if source is None:
+        return None, None, "Source not found"
+
+    inventory_content: str | None = None
+    inventory_path: str | None = None
+    if inventory_scope.startswith("steward:"):
+        async with app.db_sessionmaker() as db:
+            targets = await fetch_scope_targets(db, inventory_scope)
+        inventory_content = json.dumps(generate_inventory(targets))
+    elif inventory_scope.startswith("repo:"):
+        parts = inventory_scope.split(":", 2)
+        inventory_path = parts[2] if len(parts) == 3 else ""
+    else:
+        return None, source, "Invalid inventory_scope"
+
+    run_id = str(uuid.uuid4())
+    run = AnsibleRun(
+        id=run_id,
+        playbook_path=playbook_path,
+        inventory_path=inventory_path,
+        inventory_scope=inventory_scope,
+        source_name=source_name,
+        triggered_by=triggered_by,
+        status=AnsibleRunStatus.running,
+        started_at=datetime.now(timezone.utc),
+        params=params or None,
+    )
+    async with app.db_sessionmaker() as db:
+        async with db.begin():
+            db.add(run)
+
+    task = asyncio.create_task(
+        executor.start_run(
+            app, run_id, playbook_path, inventory_path or "",
+            source["path"], params or None, inventory_content,
+        )
+    )
+    task.add_done_callback(
+        lambda t: t.exception() and app.logger.error(
+            "Ansible run %s raised: %s", run_id, t.exception()
+        )
+    )
+    return run, source, None