feat(ansible): parameterized runs — extra-vars, limit, tags, dry-run (task 546)

Run form + executor now support optional params, passed as argv (never
shell-interpolated):
- extra_vars: one key=value per line -> repeated -e
- limit -> --limit; tags -> --tags
- dry-run checkbox -> --check --diff

- executor.py: pure build_ansible_command(playbook, inventory, params); start_run
  gains an optional params arg (backward-compatible)
- models/ansible.py + migration 0013: nullable params JSON column
- routes.py: create_run parses + validates (extra-var lines need '='), stores
  params on the run, passes to the executor
- browse.html run form: Extra vars / Limit / Tags / Dry-run fields
- run_detail.html: shows the params used
- tests/test_ansible_command.py: unit coverage of the builder; integration test
  runs a real playbook with extra-var + limit + check and asserts substitution

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/integration/test_ansible_foundation.py

@@ -99,3 +99,42 @@ def test_executor_runs_local_playbook(app, tmp_path):
     run = asyncio.run(_go())
     assert run.status == AnsibleRunStatus.success, run.output
     assert "STEWARD_ANSIBLE_OK" in (run.output or "")
+
+
+@_NEEDS_DB
+def test_executor_runs_parameterized(app, tmp_path):
+    """extra_vars + limit + check all flow through to a real run (task 546)."""
+    from sqlalchemy import select
+    from steward.ansible import executor
+    from steward.models.ansible import AnsibleRun, AnsibleRunStatus
+
+    (tmp_path / "test.yml").write_text(textwrap.dedent("""\
+        - hosts: localhost
+          connection: local
+          gather_facts: false
+          tasks:
+            - debug:
+                msg: "GOT-{{ myvar }}"
+    """))
+    (tmp_path / "inv.ini").write_text("localhost ansible_connection=local\n")
+
+    run_id = str(uuid.uuid4())
+    params = {"extra_vars": ["myvar=HELLO"], "limit": "localhost", "check": True}
+
+    async def _go():
+        async with app.db_sessionmaker() as s:
+            async with s.begin():
+                s.add(AnsibleRun(
+                    id=run_id, playbook_path="test.yml", inventory_path="inv.ini",
+                    source_name="t", triggered_by=None,
+                    status=AnsibleRunStatus.running, params=params,
+                ))
+        await executor.start_run(app, run_id, "test.yml", "inv.ini", str(tmp_path), params)
+        async with app.db_sessionmaker() as s:
+            return (await s.execute(
+                select(AnsibleRun).where(AnsibleRun.id == run_id))).scalar_one()
+
+    run = asyncio.run(_go())
+    assert run.status == AnsibleRunStatus.success, run.output
+    assert "GOT-HELLO" in (run.output or "")  # extra var substituted
+    assert run.params == params  # params round-trip through the DB