feat(ansible): runs stay inside their source; controller-side vars are admin-only (#5034)

#5034 "Playbook runs: path and inventory checks in trigger_run, connection
vars admin-only, confirm enforced server-side, web actions audited".
Ansible runs inside the Steward container, so an operator who could name
any playbook path, set ansible_connection=local or ProxyCommand ssh args,
or put {{ lookup('pipe', …) }} in a value could run commands on Steward.

- steward/ansible/guards.py: check_playbook (the source must list it),
  check_inventory_scope (steward:* or an inventory file the source has),
  check_vars_for_role (ansible_* beyond host/port/user/password/become,
  and any Jinja in a value, are admin-only), changed_vars (an edit is
  held to the role only for what it changes).
- trigger_run applies the path checks, so every run path — web, MCP,
  alerts, schedules, plugins — gets them.
- Variables are checked by role on the web run form, host-page runs,
  schedule create/update, inventory group/target create/update, and MCP
  run_playbook / create_schedule / update_schedule.
- A steward:confirm playbook needs the confirmation ticked on the server
  side for a real (non-check) web run, as MCP already required.
- Audited: runs, cancel, schedule create/update/enable/disable/delete/
  run-now, playbook create/update/delete, inventory group and target
  create/update/delete (variable names only, never values). One
  audit_request helper serves the web routes.
- The CSRF form guard and the route guard now each test that they fail
  on a synthetic broken input (rule: a guard must be able to fail).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/hosts/routes.py

@@ -221,8 +221,11 @@ async def run_playbook(host_id: str):
 
     # Shared parser: discovered var__ fields → extra_vars_map, secret__ → secret_vars
     # (unpersisted), plus tags/check. No --limit — there's exactly one host.
-    from steward.ansible.routes import _parse_run_params
+    from steward.ansible.routes import _parse_run_params, _run_vars, check_run_form
     params_or_none, secret_vars, err = _parse_run_params(form)
+    if err:
+        return err, 400
+    err = check_run_form(form, source, playbook, params_or_none, secret_vars)
     if err:
         return err, 400
 
@@ -254,7 +257,9 @@ async def run_playbook(host_id: str):
 
     await log_audit(current_app, session.get("user_id"), session.get("username", ""),
                     "ansible.host_run", entity_type="host", entity_id=host.name,
-                    detail={"playbook": playbook, "source": source_name})
+                    detail={"playbook": playbook, "source": source_name, "run_id": run_id,
+                            "check": bool((params_or_none or {}).get("check")),
+                            "vars": sorted(_run_vars(params_or_none, secret_vars))})
     return redirect(url_for("ansible.run_detail", run_id=run_id))