fix(ansible): git sources work in the image and survive a redeploy; pulls time out; alert vars go in a JSON file (#5157)

- git ships in the image; checkouts live under /data/ansible/sources
  (STEWARD_ANSIBLE_SOURCE_DIR), on the persistent volume.
- One task, ansible_git_pulls, reads the sources every 30 s and pulls each
  as its interval passes: a source added in Settings is pulled without a
  restart, a removed one is forgotten.
- git_pull: a 120 s timeout ending the process group, GIT_TERMINAL_PROMPT=0,
  pull --ff-only, a failed clone removed; it raises GitPullError with git's
  message, so the Sync button stops saying Synced after a failure (and the
  message is now escaped).
- An alert action's vars and the firing's steward_alert_* vars reach
  ansible-playbook as one JSON extra-vars file, not -e key=value, which
  Ansible split on whitespace (a rule named 'High CPU on web').

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/settings/routes.py

@@ -1,5 +1,6 @@
 # steward/settings/routes.py
 from __future__ import annotations
+import html
 import logging
 from pathlib import Path
 from quart import Blueprint, current_app, render_template, request, redirect, url_for, session
@@ -505,7 +506,8 @@ async def ansible_sync_source(idx: int):
         return '<span style="color:var(--green);font-size:0.8rem;">Synced</span>'
     except Exception as exc:
         logger.exception("git pull failed for source %r", source["name"])
-        return f'<span style="color:var(--red);font-size:0.8rem;">Sync failed: {exc}</span>'
+        return ('<span style="color:var(--red);font-size:0.8rem;">Sync failed: '
+                f'{html.escape(str(exc))}</span>')
 
 
 # ── Auth (OIDC / LDAP) ────────────────────────────────────────────────────────