feat(ansible): parameterized runs — extra-vars, limit, tags, dry-run (task 546)

Run form + executor now support optional params, passed as argv (never
shell-interpolated):
- extra_vars: one key=value per line -> repeated -e
- limit -> --limit; tags -> --tags
- dry-run checkbox -> --check --diff

- executor.py: pure build_ansible_command(playbook, inventory, params); start_run
  gains an optional params arg (backward-compatible)
- models/ansible.py + migration 0013: nullable params JSON column
- routes.py: create_run parses + validates (extra-var lines need '='), stores
  params on the run, passes to the executor
- browse.html run form: Extra vars / Limit / Tags / Dry-run fields
- run_detail.html: shows the params used
- tests/test_ansible_command.py: unit coverage of the builder; integration test
  runs a real playbook with extra-var + limit + check and asserts substitution

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/templates/ansible/browse.html

@@ -83,6 +83,25 @@
                 <label>Or enter inventory path manually</label>
                 <input type="text" id="manual-inv-{{ sd.source.name }}" placeholder="inventories/production/hosts">
             </div>
+            <div class="form-group">
+                <label>Extra vars <span style="color:var(--text-muted);font-weight:normal;">(optional, one key=value per line)</span></label>
+                <textarea name="extra_vars" rows="2" placeholder="version=1.2.3&#10;restart=true"
+                          style="width:100%;font-family:ui-monospace,monospace;font-size:0.85rem;"></textarea>
+            </div>
+            <div class="form-group">
+                <label>Limit to host(s) <span style="color:var(--text-muted);font-weight:normal;">(optional, --limit)</span></label>
+                <input type="text" name="limit" placeholder="web01,db*">
+            </div>
+            <div class="form-group">
+                <label>Tags <span style="color:var(--text-muted);font-weight:normal;">(optional, --tags)</span></label>
+                <input type="text" name="tags" placeholder="deploy,config">
+            </div>
+            <div class="form-group">
+                <label style="display:flex;align-items:center;gap:0.5rem;font-weight:normal;">
+                    <input type="checkbox" name="check">
+                    Dry-run (--check --diff) — preview changes without applying
+                </label>
+            </div>
             <div style="display:flex;gap:0.75rem;align-items:center;">
                 <button type="button" class="btn"
                     onclick="var manual=document.getElementById('manual-inv-{{ sd.source.name }}').value.trim();

steward/templates/ansible/run_detail.html

@@ -19,6 +19,20 @@
         {% if run.finished_at %}
         <span style="color:var(--text-muted);">Finished</span><span style="color:var(--text-dim);">{{ run.finished_at.strftime("%Y-%m-%d %H:%M:%S UTC") }}</span>
         {% endif %}
+        {% if run.params %}
+        {% if run.params.limit %}
+        <span style="color:var(--text-muted);">Limit</span><span style="font-family:ui-monospace,monospace;">{{ run.params.limit }}</span>
+        {% endif %}
+        {% if run.params.tags %}
+        <span style="color:var(--text-muted);">Tags</span><span style="font-family:ui-monospace,monospace;">{{ run.params.tags }}</span>
+        {% endif %}
+        {% if run.params.check %}
+        <span style="color:var(--text-muted);">Mode</span><span style="color:var(--orange);">dry-run (--check --diff)</span>
+        {% endif %}
+        {% if run.params.extra_vars %}
+        <span style="color:var(--text-muted);">Extra vars</span><span style="font-family:ui-monospace,monospace;">{{ run.params.extra_vars | join(", ") }}</span>
+        {% endif %}
+        {% endif %}
     </div>
 </div>