feat(ansible): runner robustness — cancel, concurrency, structured results, retention

Closes #550 (all four):

- Cancellation: track live subprocesses; POST /ansible/runs/<id>/cancel
  (operator) SIGTERMs then SIGKILLs after a grace; new 'cancelled' status
  (+ migration 0019, ALTER TYPE in autocommit). Queued runs cancel cleanly
  before launch. Cancel button on run detail.
- Concurrency: global semaphore (ansible.max_concurrent_runs, default 3,
  Settings→Ansible) caps simultaneous runs; excess show 'queued' (new status)
  until a slot frees. Semaphore bound lazily per running loop.
- Structured results: parse PLAY RECAP into per-host ok/changed/unreachable/
  failed/skipped + capture failed-task lines, stored in new results JSON
  column (migration 0020); rendered as a host-summary table on run detail.
  Keeps live streaming (no json-callback swap).
- Retention: full output written to a persistent log artifact
  (/data/ansible/runs/<id>.log, env-overridable) beyond the 1 MB DB cap and
  across restarts; in-memory replay buffer bounded + GC'd after completion;
  Download-log route. Boot reconciliation now also sweeps stale 'queued'.

Unit tests for recap parsing + cancel flagging. Status colors updated across
run list / detail / schedules.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/settings/routes.py

@@ -179,6 +179,7 @@ async def ansible():
         become_set=bool(settings.get("ansible.become_password")),
         vault_set=bool(settings.get("ansible.vault_password")),
         host_key_checking=settings.get("ansible.host_key_checking", False),
+        max_concurrent_runs=settings.get("ansible.max_concurrent_runs", 3),
     )
 
 
@@ -203,6 +204,11 @@ async def ansible_save_credentials():
                 if val:
                     await set_setting(db, key, val)
             await set_setting(db, "ansible.host_key_checking", "host_key_checking" in form)
+            try:
+                mcr = max(1, min(50, int(form.get("max_concurrent_runs", 3))))
+            except (TypeError, ValueError):
+                mcr = 3
+            await set_setting(db, "ansible.max_concurrent_runs", mcr)
     await _reload_app_config()
     await log_audit(current_app, session.get("user_id"), session.get("username", ""),
                     "settings.saved", detail={"section": "ansible.credentials"})