feat(ansible): ship ansible in image + allow system-triggered runs (task 545)

Foundation for the Ansible automation milestone (#37) — makes the existing
manual playbook runner actually executable and the schema automation-ready.

- pyproject: [ansible] extra (full ansible package, batteries-included, pinned)
- Dockerfile: pip install .[ansible]; add openssh-client for remote runs
- models/ansible.py + migration 0012: AnsibleRun.triggered_by now nullable so
  automated (alert/schedule) runs need no human actor
- ansible/routes.py + run_detail.html: show 'Triggered by' (username or 'system')
- CI: integration lane installs .[dev,ansible]; new tests/integration/
  test_ansible_foundation.py runs a real connection:local playbook end-to-end,
  asserts success+output, and round-trips a NULL-triggered run

No extra-vars/limit/credentials/scheduling here — those are their own #37 tasks.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/ansible/routes.py

@@ -13,7 +13,7 @@ from sqlalchemy import select
 from steward.ansible import executor, sources as src_module
 from steward.auth.middleware import require_role
 from steward.models.ansible import AnsibleRun, AnsibleRunStatus
-from steward.models.users import UserRole
+from steward.models.users import User, UserRole
 
 ansible_bp = Blueprint("ansible", __name__, url_prefix="/ansible")
 
@@ -163,6 +163,13 @@ async def run_detail(run_id: str):
     async with current_app.db_sessionmaker() as db:
         result = await db.execute(select(AnsibleRun).where(AnsibleRun.id == run_id))
         run = result.scalar_one_or_none()
-    if run is None:
-        return "Not found", 404
-    return await render_template("ansible/run_detail.html", run=run)
+        if run is None:
+            return "Not found", 404
+        # NULL triggered_by = an automated (system) run; otherwise resolve the user.
+        triggered_label = "system"
+        if run.triggered_by:
+            res = await db.execute(
+                select(User.username).where(User.id == run.triggered_by))
+            triggered_label = res.scalar_one_or_none() or "(deleted user)"
+    return await render_template(
+        "ansible/run_detail.html", run=run, triggered_label=triggered_label)

steward/migrations/versions/0012_ansible_run_triggered_by_nullable.py

@@ -0,0 +1,31 @@
+"""Make ansible_runs.triggered_by nullable (automated runs have no user)
+
+Revision ID: 0012_ansible_run_triggered_by_nullable
+Revises: 0011_audit_log
+Create Date: 2026-06-02
+"""
+from typing import Sequence, Union
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = "0012_ansible_run_triggered_by_nullable"
+down_revision: Union[str, None] = "0011_audit_log"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.alter_column(
+        "ansible_runs", "triggered_by",
+        existing_type=sa.String(36),
+        nullable=True,
+    )
+
+
+def downgrade() -> None:
+    # Re-imposes NOT NULL; will fail if any system-triggered (NULL) rows exist.
+    op.alter_column(
+        "ansible_runs", "triggered_by",
+        existing_type=sa.String(36),
+        nullable=False,
+    )

steward/models/ansible.py

@@ -21,8 +21,10 @@ class AnsibleRun(Base):
     playbook_path: Mapped[str] = mapped_column(String(512), nullable=False)
     inventory_path: Mapped[str] = mapped_column(String(512), nullable=False)
     source_name: Mapped[str] = mapped_column(String(128), nullable=False)
-    triggered_by: Mapped[str] = mapped_column(
-        String(36), ForeignKey("users.id", ondelete="RESTRICT"), nullable=False
+    # Nullable: automated runs (alert actions, schedules) have no human actor —
+    # NULL renders as "system". Manual runs still record the triggering user.
+    triggered_by: Mapped[str | None] = mapped_column(
+        String(36), ForeignKey("users.id", ondelete="RESTRICT"), nullable=True
     )
     status: Mapped[AnsibleRunStatus] = mapped_column(
         Enum(AnsibleRunStatus), nullable=False, default=AnsibleRunStatus.running

steward/templates/ansible/run_detail.html

@@ -13,6 +13,7 @@
         <span style="color:var(--text-muted);">Playbook</span><span>{{ run.playbook_path }}</span>
         <span style="color:var(--text-muted);">Inventory</span><span>{{ run.inventory_path }}</span>
         <span style="color:var(--text-muted);">Source</span><span>{{ run.source_name }}</span>
+        <span style="color:var(--text-muted);">Triggered by</span><span>{{ triggered_label }}</span>
         <span style="color:var(--text-muted);">Status</span><span style="color:{{ status_color }};font-weight:bold;">{{ run.status.value.upper() }}</span>
         <span style="color:var(--text-muted);">Started</span><span style="color:var(--text-dim);">{{ run.started_at.strftime("%Y-%m-%d %H:%M:%S UTC") }}</span>
         {% if run.finished_at %}