feat(ansible): ship ansible in image + allow system-triggered runs (task 545)

Foundation for the Ansible automation milestone (#37) — makes the existing
manual playbook runner actually executable and the schema automation-ready.

- pyproject: [ansible] extra (full ansible package, batteries-included, pinned)
- Dockerfile: pip install .[ansible]; add openssh-client for remote runs
- models/ansible.py + migration 0012: AnsibleRun.triggered_by now nullable so
  automated (alert/schedule) runs need no human actor
- ansible/routes.py + run_detail.html: show 'Triggered by' (username or 'system')
- CI: integration lane installs .[dev,ansible]; new tests/integration/
  test_ansible_foundation.py runs a real connection:local playbook end-to-end,
  asserts success+output, and round-trips a NULL-triggered run

No extra-vars/limit/credentials/scheduling here — those are their own #37 tasks.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/migrations/versions/0012_ansible_run_triggered_by_nullable.py

@@ -0,0 +1,31 @@
+"""Make ansible_runs.triggered_by nullable (automated runs have no user)
+
+Revision ID: 0012_ansible_run_triggered_by_nullable
+Revises: 0011_audit_log
+Create Date: 2026-06-02
+"""
+from typing import Sequence, Union
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = "0012_ansible_run_triggered_by_nullable"
+down_revision: Union[str, None] = "0011_audit_log"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.alter_column(
+        "ansible_runs", "triggered_by",
+        existing_type=sa.String(36),
+        nullable=True,
+    )
+
+
+def downgrade() -> None:
+    # Re-imposes NOT NULL; will fail if any system-triggered (NULL) rows exist.
+    op.alter_column(
+        "ansible_runs", "triggered_by",
+        existing_type=sa.String(36),
+        nullable=False,
+    )