feat(ansible): parameterized runs — extra-vars, limit, tags, dry-run (task 546)

Run form + executor now support optional params, passed as argv (never
shell-interpolated):
- extra_vars: one key=value per line -> repeated -e
- limit -> --limit; tags -> --tags
- dry-run checkbox -> --check --diff

- executor.py: pure build_ansible_command(playbook, inventory, params); start_run
  gains an optional params arg (backward-compatible)
- models/ansible.py + migration 0013: nullable params JSON column
- routes.py: create_run parses + validates (extra-var lines need '='), stores
  params on the run, passes to the executor
- browse.html run form: Extra vars / Limit / Tags / Dry-run fields
- run_detail.html: shows the params used
- tests/test_ansible_command.py: unit coverage of the builder; integration test
  runs a real playbook with extra-var + limit + check and asserts substitution

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/migrations/versions/0013_ansible_run_params.py

@@ -0,0 +1,22 @@
+"""Add ansible_runs.params (optional run parameters)
+
+Revision ID: 0013_ansible_run_params
+Revises: 0012_ansible_run_nullable
+Create Date: 2026-06-02
+"""
+from typing import Sequence, Union
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = "0013_ansible_run_params"
+down_revision: Union[str, None] = "0012_ansible_run_nullable"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column("ansible_runs", sa.Column("params", sa.JSON(), nullable=True))
+
+
+def downgrade() -> None:
+    op.drop_column("ansible_runs", "params")