feat(ansible): per-variable fields in the playbook run form

When you click Run, Steward now parses the playbook and renders a field
for each declared variable instead of a blank extra-vars textarea. The
form loads on demand via HTMX (/ansible/run-form/<source>/<playbook>).

- sources.discover_playbook_variables: parse vars: defaults + vars_prompt:
  (vars_prompt wins on name collision; non-scalar vars skipped; role/include
  vars not traversed). Flags secret-looking names + vars_prompt private.
- Run-time values flow through a JSON extra-vars file (-e @file), which is
  space/quote-safe — fixes a latent shlex-split bug in the old -e key=value
  textarea path. executor.build_extra_vars_file (pure) + start_run merge.
- Secret-flagged fields are masked AND routed through an unpersisted
  secret_vars channel (runner.trigger_run → start_run), so passwords entered
  at run time never land in the DB / run history.
- Defaults shown as placeholders (not prefilled): an untouched field falls
  through to the inventory/play default instead of overriding it.
- routes: run_form HTMX endpoint; _parse_run_params now returns
  (params, secret_vars, err) and reads var__/secret__ fields. Schedules drop
  secret vars (can't prompt unattended).
- templates: ansible/_run_form.html fragment; browse.html rewired to HTMX,
  static JS run-form removed. Advanced section keeps limit/tags/check + a
  free-form extra-vars escape hatch.
- tests: test_playbook_variables.py (discovery + extra-vars file).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/ansible/sources.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 import asyncio
 import logging
 import os
+import re
 import stat
 import tempfile
 from pathlib import Path
@@ -10,6 +11,12 @@ logger = logging.getLogger(__name__)
 
 INVENTORY_NAMES = {"hosts", "inventory", "inventory.yml", "inventory.ini"}
 
+# Variable names that should be entered masked + kept out of the DB. Matched
+# case-insensitively as a substring of the variable name.
+_SECRET_VAR_RE = re.compile(
+    r"(password|passwd|secret|token|api[_-]?key|private[_-]?key|credential)", re.I
+)
+
 # Name of the always-present, read-only source of first-party playbooks shipped
 # inside the app (maintenance tasks, host-agent install). Not operator-editable.
 BUILTIN_SOURCE_NAME = "steward-builtin"
@@ -188,6 +195,64 @@ def delete_playbook(source_path: str, relative_path: str) -> tuple[bool, str | N
     return True, None
 
 
+def discover_playbook_variables(content: str) -> list[dict]:
+    """Parse a playbook and list the variables an operator can set at run time.
+
+    Surfaces two sources, in this precedence (first wins on name collision):
+      - ``vars_prompt:`` — Ansible's explicit "ask me" mechanism. ``required``
+        when it has no default; ``secret`` when ``private`` (Ansible's default
+        is private=yes) or the name looks sensitive.
+      - ``vars:`` scalar entries — shown with their default as a placeholder
+        (NOT prefilled, so an untouched field falls through to inventory/play
+        defaults rather than overriding them).
+
+    Only top-level plays are inspected — role defaults and included var files are
+    not traversed (kept simple + predictable). Returns a list of dicts:
+    {name, default, secret, required, prompt}.
+    """
+    import yaml
+    try:
+        plays = yaml.safe_load(content)
+    except yaml.YAMLError:
+        return []
+    if not isinstance(plays, list):
+        return []
+
+    out: list[dict] = []
+    seen: set[str] = set()
+
+    def add(name, default, secret, required, prompt=None):
+        if not isinstance(name, str) or name in seen:
+            return
+        seen.add(name)
+        out.append({
+            "name": name,
+            "default": "" if default is None else default,
+            "secret": secret,
+            "required": required,
+            "prompt": prompt,
+        })
+
+    for play in plays:
+        if not isinstance(play, dict):
+            continue
+        for vp in play.get("vars_prompt") or []:
+            if not isinstance(vp, dict) or "name" not in vp:
+                continue
+            name = vp["name"]
+            default = vp.get("default")
+            private = bool(vp.get("private", True))  # Ansible defaults private=yes
+            add(name, default, private or bool(_SECRET_VAR_RE.search(str(name))),
+                default is None, vp.get("prompt"))
+        play_vars = play.get("vars")
+        if isinstance(play_vars, dict):
+            for name, default in play_vars.items():
+                # Only scalar defaults map cleanly to a single input field.
+                if isinstance(default, (str, int, float, bool)) or default is None:
+                    add(name, default, bool(_SECRET_VAR_RE.search(str(name))), False)
+    return out
+
+
 def validate_playbook_yaml(content: str) -> tuple[bool, str | None]:
     """Cheap save-time validation: parses as YAML and is a non-empty play list."""
     import yaml