feat(ansible): parameterized runs — extra-vars, limit, tags, dry-run (task 546)

Run form + executor now support optional params, passed as argv (never
shell-interpolated):
- extra_vars: one key=value per line -> repeated -e
- limit -> --limit; tags -> --tags
- dry-run checkbox -> --check --diff

- executor.py: pure build_ansible_command(playbook, inventory, params); start_run
  gains an optional params arg (backward-compatible)
- models/ansible.py + migration 0013: nullable params JSON column
- routes.py: create_run parses + validates (extra-var lines need '='), stores
  params on the run, passes to the executor
- browse.html run form: Extra vars / Limit / Tags / Dry-run fields
- run_detail.html: shows the params used
- tests/test_ansible_command.py: unit coverage of the builder; integration test
  runs a real playbook with extra-var + limit + check and asserts substitution

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/ansible/routes.py

@@ -85,6 +85,30 @@ async def create_run():
     if source is None:
         return "Source not found", 404
 
+    # Optional run parameters (all passed as argv by the executor — no shell).
+    extra_vars: list[str] = []
+    for line in (form.get("extra_vars", "") or "").splitlines():
+        line = line.strip()
+        if not line:
+            continue
+        if "=" not in line:
+            return f"Invalid extra var (expected key=value): {line!r}", 400
+        extra_vars.append(line)
+    limit = (form.get("limit", "") or "").strip()
+    tags = (form.get("tags", "") or "").strip()
+    check = "check" in form
+
+    params: dict = {}
+    if extra_vars:
+        params["extra_vars"] = extra_vars
+    if limit:
+        params["limit"] = limit
+    if tags:
+        params["tags"] = tags
+    if check:
+        params["check"] = True
+    params_or_none = params or None
+
     run_id = str(uuid.uuid4())
     now = datetime.now(timezone.utc)
 
@@ -96,6 +120,7 @@ async def create_run():
         triggered_by=session["user_id"],
         status=AnsibleRunStatus.running,
         started_at=now,
+        params=params_or_none,
     )
     async with current_app.db_sessionmaker() as db:
         async with db.begin():
@@ -108,6 +133,7 @@ async def create_run():
             playbook_path,
             inventory_path,
             source["path"],
+            params_or_none,
         )
     )
     task.add_done_callback(