fix(ansible): replace steward key on reprovision + distinct agent update path

Provisioning review corrections + the matching frontend, plus breadcrumb
header integration.

- provision.yml: authorize the managed pubkey with a regexp match on the
  ' steward-managed' comment so rotating the key REPLACES the host's steward
  key in place instead of stacking a second authorized entry. Hand-added keys
  (other comments) are untouched.
- update.yml (new): refresh agent.py + restart only. Does NOT rotate the token
  or rewrite /etc/steward-agent.conf — the host keeps its identity. Asserts the
  agent is already installed and fails clearly otherwise.
- host_agent /update route: runs update.yml as the managed steward user (no
  token minting). Token rotation stays a deliberate action.
- settings/ansible/generate-key honors a safe relative `next` redirect, so an
  inline trigger elsewhere returns to its page.
- Host Agents settings: reworked into a clear lifecycle — an intro card that
  explains it runs Ansible to deploy the agent (+ inline "generate managed key"
  warning/trigger when none exists), then three labelled cards: 1 Provision,
  2 Install/enroll, 3 Update. Each explains what it does.
- base.html: breadcrumb now renders as a kicker line directly above the page
  title (moved below alerts, tightened margin) so nested and top-level views
  share one consistent header.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/templates/base.html

@@ -146,7 +146,9 @@ textarea { resize: vertical; }
 .empty { color: var(--text-muted); font-size: 0.9rem; padding: 2rem; text-align: center; }
 
 /* Breadcrumbs */
-.breadcrumb { display:flex; align-items:center; flex-wrap:wrap; gap:0.35rem; font-size:0.8rem; color:var(--text-dim); margin-bottom:1rem; }
+/* Breadcrumb renders as a kicker line tucked directly above the page header
+   (.page-title), so nested and top-level views share one consistent header. */
+.breadcrumb { display:flex; align-items:center; flex-wrap:wrap; gap:0.35rem; font-size:0.78rem; color:var(--text-dim); margin:0 0 0.45rem; }
 .breadcrumb a { color:var(--text-muted); }
 .breadcrumb a:hover { color:var(--text); }
 .breadcrumb-sep { color:var(--border-mid); }
@@ -235,7 +237,6 @@ function setTimeRange(val) {
 </script>
 
     <main>
-        {% block breadcrumb %}{% endblock %}
         {% if plugin_failures and session.user_role == 'admin' %}
         <div style="background:color-mix(in srgb,var(--yellow) 12%,var(--bg-elevated));
                     border:1px solid color-mix(in srgb,var(--yellow) 35%,var(--border));
@@ -253,6 +254,7 @@ function setTimeRange(val) {
         {% if error %}
         <div class="alert alert-error">{{ error }}</div>
         {% endif %}
+        {% block breadcrumb %}{% endblock %}
         {% block content %}{% endblock %}
     </main>