feat(ansible): GIT_ASKPASS per-source HTTP token auth + settings UI

steward/templates/settings/_ansible_sources.html

@@ -94,6 +94,15 @@
                 <label style="font-size:0.8rem;">Pull interval (seconds)</label>
                 <input type="number" name="pull_interval_seconds" value="{{ src.pull_interval_seconds or 3600 }}" min="60">
               </div>
+              <div class="form-group" style="margin:0;grid-column:1/-1;">
+                <label style="font-size:0.8rem;">
+                  HTTP Token
+                  <span style="color:var(--text-muted);font-weight:normal;">(optional — Gitea PAT for private repos)</span>
+                </label>
+                <input type="password" name="http_token"
+                       placeholder="{% if src.http_token %}token saved — enter new to replace{% endif %}"
+                       autocomplete="new-password">
+              </div>
             </div>
 
             <div id="ansible-edit-local-fields-{{ idx }}"
@@ -165,6 +174,12 @@
             <label style="font-size:0.8rem;">Pull interval (seconds)</label>
             <input type="number" name="pull_interval_seconds" value="3600" min="60">
           </div>
+          <div class="form-group" style="margin:0;grid-column:1/-1;">
+            <label style="font-size:0.8rem;">HTTP Token
+              <span style="color:var(--text-muted);font-weight:normal;">(optional)</span>
+            </label>
+            <input type="password" name="http_token" autocomplete="new-password">
+          </div>
         </div>
 
         <div id="ansible-add-local-fields"