feat(ansible): ship ansible in image + allow system-triggered runs (task 545)

Foundation for the Ansible automation milestone (#37) — makes the existing
manual playbook runner actually executable and the schema automation-ready.

- pyproject: [ansible] extra (full ansible package, batteries-included, pinned)
- Dockerfile: pip install .[ansible]; add openssh-client for remote runs
- models/ansible.py + migration 0012: AnsibleRun.triggered_by now nullable so
  automated (alert/schedule) runs need no human actor
- ansible/routes.py + run_detail.html: show 'Triggered by' (username or 'system')
- CI: integration lane installs .[dev,ansible]; new tests/integration/
  test_ansible_foundation.py runs a real connection:local playbook end-to-end,
  asserts success+output, and round-trips a NULL-triggered run

No extra-vars/limit/credentials/scheduling here — those are their own #37 tasks.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -5,6 +5,8 @@ RUN DEBIAN_FRONTEND=noninteractive apt-get update \
         iputils-ping \
         # gosu — minimal privilege-drop tool used by entrypoint.sh
         gosu \
+        # openssh-client — ansible-playbook reaches remote hosts over ssh
+        openssh-client \
     && rm -rf /var/lib/apt/lists/*
 
 # Upgrade pip to suppress the version notice
@@ -14,7 +16,8 @@ WORKDIR /app
 
 COPY pyproject.toml .
 COPY steward/ steward/
-RUN pip install --no-cache-dir .
+# .[ansible] pulls the full Ansible package so the playbook runner works in-image.
+RUN pip install --no-cache-dir '.[ansible]'
 
 COPY alembic.ini .
 # First-party plugins ship inside the image (bundled root at /app/plugins).