feat(ansible): parameterized runs — extra-vars, limit, tags, dry-run (task 546)

Run form + executor now support optional params, passed as argv (never
shell-interpolated):
- extra_vars: one key=value per line -> repeated -e
- limit -> --limit; tags -> --tags
- dry-run checkbox -> --check --diff

- executor.py: pure build_ansible_command(playbook, inventory, params); start_run
  gains an optional params arg (backward-compatible)
- models/ansible.py + migration 0013: nullable params JSON column
- routes.py: create_run parses + validates (extra-var lines need '='), stores
  params on the run, passes to the executor
- browse.html run form: Extra vars / Limit / Tags / Dry-run fields
- run_detail.html: shows the params used
- tests/test_ansible_command.py: unit coverage of the builder; integration test
  runs a real playbook with extra-var + limit + check and asserts substitution

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/integration/test_ansible_foundation.py

@@ -99,3 +99,42 @@ def test_executor_runs_local_playbook(app, tmp_path):
     run = asyncio.run(_go())
     assert run.status == AnsibleRunStatus.success, run.output
     assert "STEWARD_ANSIBLE_OK" in (run.output or "")
+
+
+@_NEEDS_DB
+def test_executor_runs_parameterized(app, tmp_path):
+    """extra_vars + limit + check all flow through to a real run (task 546)."""
+    from sqlalchemy import select
+    from steward.ansible import executor
+    from steward.models.ansible import AnsibleRun, AnsibleRunStatus
+
+    (tmp_path / "test.yml").write_text(textwrap.dedent("""\
+        - hosts: localhost
+          connection: local
+          gather_facts: false
+          tasks:
+            - debug:
+                msg: "GOT-{{ myvar }}"
+    """))
+    (tmp_path / "inv.ini").write_text("localhost ansible_connection=local\n")
+
+    run_id = str(uuid.uuid4())
+    params = {"extra_vars": ["myvar=HELLO"], "limit": "localhost", "check": True}
+
+    async def _go():
+        async with app.db_sessionmaker() as s:
+            async with s.begin():
+                s.add(AnsibleRun(
+                    id=run_id, playbook_path="test.yml", inventory_path="inv.ini",
+                    source_name="t", triggered_by=None,
+                    status=AnsibleRunStatus.running, params=params,
+                ))
+        await executor.start_run(app, run_id, "test.yml", "inv.ini", str(tmp_path), params)
+        async with app.db_sessionmaker() as s:
+            return (await s.execute(
+                select(AnsibleRun).where(AnsibleRun.id == run_id))).scalar_one()
+
+    run = asyncio.run(_go())
+    assert run.status == AnsibleRunStatus.success, run.output
+    assert "GOT-HELLO" in (run.output or "")  # extra var substituted
+    assert run.params == params  # params round-trip through the DB

tests/test_ansible_command.py

@@ -0,0 +1,42 @@
+"""Unit tests for the ansible-playbook command builder (task 546)."""
+from steward.ansible.executor import build_ansible_command
+
+BASE = ["ansible-playbook", "site.yml", "-i", "inv.ini"]
+
+
+def test_base_no_params():
+    assert build_ansible_command("site.yml", "inv.ini") == BASE
+    assert build_ansible_command("site.yml", "inv.ini", None) == BASE
+    assert build_ansible_command("site.yml", "inv.ini", {}) == BASE
+
+
+def test_extra_vars_each_passed_as_argv():
+    cmd = build_ansible_command("site.yml", "inv.ini", {"extra_vars": ["a=1", "b=two words"]})
+    assert cmd == BASE + ["-e", "a=1", "-e", "b=two words"]
+
+
+def test_limit_and_tags():
+    cmd = build_ansible_command("site.yml", "inv.ini", {"limit": "web*", "tags": "deploy,cfg"})
+    assert cmd[cmd.index("--limit") + 1] == "web*"
+    assert cmd[cmd.index("--tags") + 1] == "deploy,cfg"
+
+
+def test_check_adds_check_and_diff():
+    cmd = build_ansible_command("site.yml", "inv.ini", {"check": True})
+    assert cmd == BASE + ["--check", "--diff"]
+
+
+def test_falsey_values_are_skipped():
+    cmd = build_ansible_command(
+        "site.yml", "inv.ini",
+        {"extra_vars": [], "limit": "", "tags": "", "check": False},
+    )
+    assert cmd == BASE
+
+
+def test_all_combined_order():
+    cmd = build_ansible_command(
+        "site.yml", "inv.ini",
+        {"extra_vars": ["v=1"], "limit": "h1", "tags": "t1", "check": True},
+    )
+    assert cmd == BASE + ["-e", "v=1", "--limit", "h1", "--tags", "t1", "--check", "--diff"]