feat(ansible): runs stay inside their source; controller-side vars are admin-only (#5034)

#5034 "Playbook runs: path and inventory checks in trigger_run, connection
vars admin-only, confirm enforced server-side, web actions audited".
Ansible runs inside the Steward container, so an operator who could name
any playbook path, set ansible_connection=local or ProxyCommand ssh args,
or put {{ lookup('pipe', …) }} in a value could run commands on Steward.

- steward/ansible/guards.py: check_playbook (the source must list it),
  check_inventory_scope (steward:* or an inventory file the source has),
  check_vars_for_role (ansible_* beyond host/port/user/password/become,
  and any Jinja in a value, are admin-only), changed_vars (an edit is
  held to the role only for what it changes).
- trigger_run applies the path checks, so every run path — web, MCP,
  alerts, schedules, plugins — gets them.
- Variables are checked by role on the web run form, host-page runs,
  schedule create/update, inventory group/target create/update, and MCP
  run_playbook / create_schedule / update_schedule.
- A steward:confirm playbook needs the confirmation ticked on the server
  side for a real (non-check) web run, as MCP already required.
- Audited: runs, cancel, schedule create/update/enable/disable/delete/
  run-now, playbook create/update/delete, inventory group and target
  create/update/delete (variable names only, never values). One
  audit_request helper serves the web routes.
- The CSRF form guard and the route guard now each test that they fail
  on a synthetic broken input (rule: a guard must be able to fail).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/mcp/tools/automation.py

@@ -19,10 +19,10 @@ from datetime import timedelta
 from sqlalchemy import select
 from sqlalchemy.orm import selectinload
 
-from steward.ansible import executor, sources as src_module
+from steward.ansible import executor, guards, sources as src_module
 from steward.ansible.inventory_gen import scope_labels
 from steward.ansible.runner import trigger_run
-from steward.mcp._context import current_caller, mcp_app, public_url
+from steward.mcp._context import current_caller, current_caller_or_none, mcp_app, public_url
 from steward.models.alerts import AlertRule
 from steward.models.ansible import AnsibleRun, AnsibleRunStatus
 from steward.models.ansible_inventory import AnsibleGroup, AnsibleTarget
@@ -118,6 +118,17 @@ def split_vars(variables: list[dict], extra_vars: dict | None) -> tuple[dict, di
     return plain, secret
 
 
+def check_caller_vars(extra_vars: dict | None, previous: dict | None = None) -> None:
+    """Refuse variables this caller's role may not set (ansible/guards.py):
+    connection-type ansible_* names and Jinja in values are admin-only. On an
+    update only what changes is held to it."""
+    caller = current_caller_or_none()
+    err = guards.check_vars_for_role(guards.changed_vars(extra_vars, previous),
+                                     caller.role if caller else None)
+    if err:
+        raise ValueError(f"{err} Nothing was run or saved.")
+
+
 def build_params(plain: dict, limit: str, tags: str, check: bool) -> dict:
     params: dict = {}
     if plain:
@@ -437,6 +448,7 @@ async def run_playbook(source: str, playbook: str, scope: str = "all",
         raise ValueError(f"{playbook} is flagged destructive by its author (steward:confirm). "
                          "Run it with check=true first; to apply, pass check=false and "
                          "confirmed=true. Nothing was run.")
+    check_caller_vars(extra_vars)
     variables = src_module.discover_playbook_variables(content)
     extra_vars, filled = steward_defaults(s, variables, extra_vars)
     plain, secret = split_vars(variables, extra_vars)
@@ -564,6 +576,7 @@ async def create_schedule(name: str, source: str, playbook: str, interval_s: int
     """
     if not (name or "").strip():
         raise ValueError("a schedule needs a name.")
+    check_caller_vars(extra_vars)
     async with db_session() as db, db.begin():
         fields = await _schedule_fields(db, source, playbook, scope, extra_vars, limit, tags, check)
         sc = AnsibleSchedule(name=name.strip()[:128], interval_seconds=_interval(interval_s),
@@ -589,6 +602,8 @@ async def update_schedule(schedule: str, name: str | None = None, source: str |
     async with db_session() as db, db.begin():
         sc = pick(schedule, await _schedules(db), kind="schedule", list_tool="list_schedules")
         params = dict(sc.params or {})
+        if extra_vars is not None:
+            check_caller_vars(extra_vars, params.get("extra_vars_map"))
         cur_scope = sc.inventory_scope
         if cur_scope.startswith("repo:"):
             cur_scope = "inventory:" + cur_scope.rsplit(":", 1)[-1]