[simonjcarr]

Summary

• add encrypted Ansible SSH credential profiles and admin management UI
• add feature-gated host/group Ansible ping task runs backed by the optional ansible-api service
• extend ansible-api with the /api/v1/runs/ansible-ping execution contract and tests
• add Drizzle migration, docs, progress tracking, and E2E coverage for the automation settings flow

Replacement PR

• Replaces feat(automation): add ansible ping execution #1309 and feat(automation): add ansible ping execution #1310.
• This branch is a clean single-commit branch from origin/main; local gitleaks detect --redact --log-opts "origin/main..HEAD" passes.

Validation

• python3 -m unittest discover -s tests from apps/ansible-api
• gitleaks detect --redact --log-opts "origin/main..HEAD"
• pnpm --dir apps/web exec node --experimental-strip-types --test lib/automation/ansible-runner.test.mjs lib/automation/settings-core.test.mjs lib/feature-flags.test.mjs lib/actions/task-runs-authz.test.mjs lib/actions/mutation-authz.test.mjs
• DATABASE_URL=postgres://ctops:ctops@localhost:5432/ctops pnpm --dir apps/web run db:validate
• pnpm --dir apps/web run type-check
• pnpm --dir apps/web run lint (passes with existing warnings)
• DATABASE_URL=postgres://ctops:ctops@localhost:5432/ctops BETTER_AUTH_SECRET=0123456789abcdef0123456789abcdef BETTER_AUTH_URL=http://localhost:3000 pnpm --dir apps/web run build (passes with existing NFT warning)
• bash deploy/scripts/test-ansible-profile-wiring.sh

Known local limitation

• pnpm --dir apps/web run test:unit still fails at lib/integrations/ct-cve/db-nonce-store.test.mjs because Testcontainers cannot find a working local container runtime in this environment.
• pnpm --dir apps/web exec node tests/e2e/runner.mjs tests/e2e/settings/automation.spec.ts is blocked for the same missing local container runtime before the app starts.