feat(ansible): ship ansible in image + allow system-triggered runs (task 545)

Foundation for the Ansible automation milestone (#37) — makes the existing
manual playbook runner actually executable and the schema automation-ready.

- pyproject: [ansible] extra (full ansible package, batteries-included, pinned)
- Dockerfile: pip install .[ansible]; add openssh-client for remote runs
- models/ansible.py + migration 0012: AnsibleRun.triggered_by now nullable so
  automated (alert/schedule) runs need no human actor
- ansible/routes.py + run_detail.html: show 'Triggered by' (username or 'system')
- CI: integration lane installs .[dev,ansible]; new tests/integration/
  test_ansible_foundation.py runs a real connection:local playbook end-to-end,
  asserts success+output, and round-trips a NULL-triggered run

No extra-vars/limit/credentials/scheduling here — those are their own #37 tasks.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/ansible/routes.py

@@ -13,7 +13,7 @@ from sqlalchemy import select
 from steward.ansible import executor, sources as src_module
 from steward.auth.middleware import require_role
 from steward.models.ansible import AnsibleRun, AnsibleRunStatus
-from steward.models.users import UserRole
+from steward.models.users import User, UserRole
 
 ansible_bp = Blueprint("ansible", __name__, url_prefix="/ansible")
 
@@ -163,6 +163,13 @@ async def run_detail(run_id: str):
     async with current_app.db_sessionmaker() as db:
         result = await db.execute(select(AnsibleRun).where(AnsibleRun.id == run_id))
         run = result.scalar_one_or_none()
-    if run is None:
-        return "Not found", 404
-    return await render_template("ansible/run_detail.html", run=run)
+        if run is None:
+            return "Not found", 404
+        # NULL triggered_by = an automated (system) run; otherwise resolve the user.
+        triggered_label = "system"
+        if run.triggered_by:
+            res = await db.execute(
+                select(User.username).where(User.id == run.triggered_by))
+            triggered_label = res.scalar_one_or_none() or "(deleted user)"
+    return await render_template(
+        "ansible/run_detail.html", run=run, triggered_label=triggered_label)