feat(ansible): dropdown playbook selection + auto-populated variable fields

Stop making operators type playbook paths and guess extra-var names.

- Reusable infra: shared ansible/_playbook_vars.html (the discovered-variable
  fields) + ansible/_playbook_options.html; two HTMX endpoints —
  /ansible/playbook-options (a source's playbooks, optional ?selected for edit)
  and /ansible/playbook-vars (a playbook's vars:/vars_prompt: as fill-in
  fields). browse _run_form.html refactored to include the shared partial.
- Host "Run a playbook against this host": source dropdown → playbook dropdown
  → variable fields, all chained via HTMX. Handler reuses _parse_run_params so
  var__/secret__ fields flow through extra_vars_map + the unpersisted
  secret_vars channel.
- Schedules: playbook free-text+datalist → source-dependent dropdown; fixed the
  extra-vars edit pre-fill to read extra_vars_map (stale list key after the
  earlier JSON-extra-vars change).

Scribe #895.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/hosts/routes.py

@@ -349,24 +349,12 @@ async def run_playbook(host_id: str):
     if playbook not in ansible_src.discover_playbooks(source["path"]):
         return f"Playbook '{playbook}' not found in source '{source_name}'", 404
 
-    # Optional params (no --limit — there's exactly one host).
-    extra_vars: list[str] = []
-    for line in (form.get("extra_vars", "") or "").splitlines():
-        line = line.strip()
-        if not line:
-            continue
-        if "=" not in line:
-            return f"Invalid extra var (expected key=value): {line!r}", 400
-        extra_vars.append(line)
-    params: dict = {}
-    if extra_vars:
-        params["extra_vars"] = extra_vars
-    tags = (form.get("tags", "") or "").strip()
-    if tags:
-        params["tags"] = tags
-    if "check" in form:
-        params["check"] = True
-    params_or_none = params or None
+    # Shared parser: discovered var__ fields → extra_vars_map, secret__ → secret_vars
+    # (unpersisted), plus tags/check. No --limit — there's exactly one host.
+    from steward.ansible.routes import _parse_run_params
+    params_or_none, secret_vars, err = _parse_run_params(form)
+    if err:
+        return err, 400
 
     run_id = str(uuid.uuid4())
     inv_content = ansible_src.host_inventory_content(host)
@@ -387,7 +375,7 @@ async def run_playbook(host_id: str):
         executor.start_run(
             current_app._get_current_object(),  # type: ignore[attr-defined]
             run_id, playbook, f"host: {host.name}", source["path"],
-            params_or_none, inv_content,
+            params_or_none, inv_content, secret_vars=secret_vars,
         )
     )
     task.add_done_callback(