feat(ansible): in-app playbook authoring/editor

Adds create/edit/delete of playbooks from the UI (admin only), so a homelab
user without a git workflow can author automation in-app. A new always-present
writable local source "steward-local" (/data/ansible/playbooks, env-overridable,
created on first save) is editable alongside operator local-dir sources; the
bundled and git sources stay read-only (git is GitOps, clobbered on pull).

sources.py: write_playbook / delete_playbook (traversal-guarded, .yml/.yaml
only) + validate_playbook_yaml (YAML + play-list check) + is_editable_source.
routes.py: /playbooks/new, /edit, /save, /delete (admin). Browse gains a
"New playbook" button and per-playbook + view-page Edit/Delete for editable
sources. Plain textarea editor with save-time YAML validation. Unit tests for
write/delete/guard/validate.

Task #579 — completes milestone #37 (Ansible automation).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/templates/ansible/browse.html

@@ -3,14 +3,30 @@
 {% block content %}
 <div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:1.5rem;">
     <h1 class="page-title" style="margin-bottom:0;">Browse Playbooks</h1>
-    <a href="/ansible/" class="btn btn-ghost btn-sm">← Run History</a>
+    <div style="display:flex;gap:0.5rem;">
+      {% if session.user_role == 'admin' %}
+      <a href="/ansible/playbooks/new" class="btn btn-sm">New playbook</a>
+      {% endif %}
+      <a href="/ansible/" class="btn btn-ghost btn-sm">← Run History</a>
+    </div>
 </div>
 
 {% if view_contents is defined %}
 <div class="card">
     <div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:1rem;">
         <h3 class="section-title">{{ view_path }}</h3>
-        <a href="/ansible/browse" class="btn btn-ghost btn-sm">← Back to browse</a>
+        <div style="display:flex;gap:0.5rem;">
+            {% if view_editable and session.user_role == 'admin' %}
+            <a href="/ansible/playbooks/edit/{{ view_source }}/{{ view_path }}" class="btn btn-sm">Edit</a>
+            <form method="post" action="/ansible/playbooks/delete" style="display:inline;"
+                  onsubmit="return confirm('Delete {{ view_path }}?');">
+                <input type="hidden" name="source_name" value="{{ view_source }}">
+                <input type="hidden" name="playbook_path" value="{{ view_path }}">
+                <button type="submit" class="btn btn-sm btn-danger">Delete</button>
+            </form>
+            {% endif %}
+            <a href="/ansible/browse" class="btn btn-ghost btn-sm">← Back to browse</a>
+        </div>
     </div>
     <pre style="background:var(--bg);padding:1rem;border-radius:4px;overflow-x:auto;font-size:0.8rem;color:var(--text-muted);max-height:600px;overflow-y:auto;">{{ view_contents }}</pre>
 </div>
@@ -47,6 +63,9 @@
             <td style="font-family:ui-monospace,monospace;font-size:0.88rem;">{{ pb }}</td>
             <td class="td-actions">
                 <a href="/ansible/browse/{{ sd.source.name }}/{{ pb }}" class="btn btn-sm btn-ghost" style="margin-right:0.5rem;">View</a>
+                {% if sd.editable and session.user_role == 'admin' %}
+                <a href="/ansible/playbooks/edit/{{ sd.source.name }}/{{ pb }}" class="btn btn-sm btn-ghost" style="margin-right:0.5rem;">Edit</a>
+                {% endif %}
                 <a href="#run-form-{{ sd.source.name }}"
                    onclick="document.getElementById('run-form-{{ sd.source.name }}').style.display='block';
                             document.getElementById('run-playbook-{{ sd.source.name }}').value='{{ pb }}';