feat(ansible): ship ansible in image + allow system-triggered runs (task 545)

Foundation for the Ansible automation milestone (#37) — makes the existing
manual playbook runner actually executable and the schema automation-ready.

- pyproject: [ansible] extra (full ansible package, batteries-included, pinned)
- Dockerfile: pip install .[ansible]; add openssh-client for remote runs
- models/ansible.py + migration 0012: AnsibleRun.triggered_by now nullable so
  automated (alert/schedule) runs need no human actor
- ansible/routes.py + run_detail.html: show 'Triggered by' (username or 'system')
- CI: integration lane installs .[dev,ansible]; new tests/integration/
  test_ansible_foundation.py runs a real connection:local playbook end-to-end,
  asserts success+output, and round-trips a NULL-triggered run

No extra-vars/limit/credentials/scheduling here — those are their own #37 tasks.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

steward/models/ansible.py

@@ -21,8 +21,10 @@ class AnsibleRun(Base):
     playbook_path: Mapped[str] = mapped_column(String(512), nullable=False)
     inventory_path: Mapped[str] = mapped_column(String(512), nullable=False)
     source_name: Mapped[str] = mapped_column(String(128), nullable=False)
-    triggered_by: Mapped[str] = mapped_column(
-        String(36), ForeignKey("users.id", ondelete="RESTRICT"), nullable=False
+    # Nullable: automated runs (alert actions, schedules) have no human actor —
+    # NULL renders as "system". Manual runs still record the triggering user.
+    triggered_by: Mapped[str | None] = mapped_column(
+        String(36), ForeignKey("users.id", ondelete="RESTRICT"), nullable=True
     )
     status: Mapped[AnsibleRunStatus] = mapped_column(
         Enum(AnsibleRunStatus), nullable=False, default=AnsibleRunStatus.running