feat(ansible): runner robustness — cancel, concurrency, structured results, retention

Closes #550 (all four):

- Cancellation: track live subprocesses; POST /ansible/runs/<id>/cancel
  (operator) SIGTERMs then SIGKILLs after a grace; new 'cancelled' status
  (+ migration 0019, ALTER TYPE in autocommit). Queued runs cancel cleanly
  before launch. Cancel button on run detail.
- Concurrency: global semaphore (ansible.max_concurrent_runs, default 3,
  Settings→Ansible) caps simultaneous runs; excess show 'queued' (new status)
  until a slot frees. Semaphore bound lazily per running loop.
- Structured results: parse PLAY RECAP into per-host ok/changed/unreachable/
  failed/skipped + capture failed-task lines, stored in new results JSON
  column (migration 0020); rendered as a host-summary table on run detail.
  Keeps live streaming (no json-callback swap).
- Retention: full output written to a persistent log artifact
  (/data/ansible/runs/<id>.log, env-overridable) beyond the 1 MB DB cap and
  across restarts; in-memory replay buffer bounded + GC'd after completion;
  Download-log route. Boot reconciliation now also sweeps stale 'queued'.

Unit tests for recap parsing + cancel flagging. Status colors updated across
run list / detail / schedules.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/core/test_ansible_executor.py

@@ -0,0 +1,35 @@
+"""Unit tests for executor structured-results parsing + cancel flagging."""
+from steward.ansible.executor import _cancelled, cancel_run, parse_recap
+
+
+def test_parse_recap_extracts_per_host_counts():
+    lines = [
+        "PLAY RECAP *****************************************************************",
+        "web01      : ok=5    changed=2    unreachable=0    failed=0    skipped=1    rescued=0",
+        "db01       : ok=3    changed=0    unreachable=1    failed=0    skipped=0",
+    ]
+    hosts = parse_recap(lines)
+    assert hosts["web01"] == {"ok": 5, "changed": 2, "unreachable": 0, "failed": 0, "skipped": 1}
+    assert hosts["db01"]["unreachable"] == 1
+    assert hosts["db01"]["ok"] == 3
+
+
+def test_parse_recap_ignores_lines_before_recap():
+    lines = [
+        "TASK [whatever] ****",
+        "ok: [web01]",
+        "PLAY RECAP ****",
+        "web01 : ok=1 changed=0 unreachable=0 failed=0 skipped=0",
+    ]
+    assert set(parse_recap(lines)) == {"web01"}
+
+
+def test_parse_recap_empty_without_recap():
+    assert parse_recap(["TASK [x] ***", "ok: [h]"]) == {}
+
+
+def test_cancel_run_flags_untracked_run():
+    rid = "nonexistent-run-id"
+    assert cancel_run(rid) is True
+    assert rid in _cancelled
+    _cancelled.discard(rid)