feat(ansible): parameterized runs — extra-vars, limit, tags, dry-run (task 546)

Run form + executor now support optional params, passed as argv (never
shell-interpolated):
- extra_vars: one key=value per line -> repeated -e
- limit -> --limit; tags -> --tags
- dry-run checkbox -> --check --diff

- executor.py: pure build_ansible_command(playbook, inventory, params); start_run
  gains an optional params arg (backward-compatible)
- models/ansible.py + migration 0013: nullable params JSON column
- routes.py: create_run parses + validates (extra-var lines need '='), stores
  params on the run, passes to the executor
- browse.html run form: Extra vars / Limit / Tags / Dry-run fields
- run_detail.html: shows the params used
- tests/test_ansible_command.py: unit coverage of the builder; integration test
  runs a real playbook with extra-var + limit + check and asserts substitution

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/ansible/executor.py

@@ -59,12 +59,37 @@ def _broadcast(run_id: str, item: str | _Done) -> None:
         _run_listeners.pop(run_id, None)
 
 
+def build_ansible_command(
+    playbook_path: str,
+    inventory_path: str,
+    params: dict | None = None,
+) -> list[str]:
+    """Build the ansible-playbook argv from a run's optional params.
+
+    Pure (no IO). Everything is passed as argv — never shell-interpolated — so
+    extra-var values and limits can contain arbitrary characters safely.
+    params keys: extra_vars (list of "key=value"), limit, tags, check (bool).
+    """
+    cmd = ["ansible-playbook", playbook_path, "-i", inventory_path]
+    params = params or {}
+    for ev in params.get("extra_vars") or []:
+        cmd += ["-e", ev]
+    if params.get("limit"):
+        cmd += ["--limit", params["limit"]]
+    if params.get("tags"):
+        cmd += ["--tags", params["tags"]]
+    if params.get("check"):
+        cmd += ["--check", "--diff"]
+    return cmd
+
+
 async def start_run(
     app: "Quart",
     run_id: str,
     playbook_path: str,
     inventory_path: str,
     source_path: str,
+    params: dict | None = None,
 ) -> None:
     """Execute ansible-playbook as a subprocess and update the DB run row."""
     _run_lines[run_id] = []
@@ -92,7 +117,7 @@ async def start_run(
         lines_since_flush = 0
         last_flush_at = time.monotonic()
 
-    cmd = ["ansible-playbook", playbook_path, "-i", inventory_path]
+    cmd = build_ansible_command(playbook_path, inventory_path, params)
     cwd = source_path if Path(source_path).exists() else None
 
     try: