feat(ansible): add simple pairing flow

[simonjcarr]

Summary

• simplify Ansible automation setup to URL, initial username, and initial password
• add Ansible API pairing endpoint that generates/rotates persisted HMAC service tokens
• wire compose/start-script defaults and docs for pairing credentials and Ansible token storage

Validation

• python3 -m unittest tests/test_contract.py (apps/ansible-api)
• pnpm --dir apps/web type-check
• pnpm --dir apps/web db:validate
• pnpm --dir apps/web lint 'app/(dashboard)/settings/integrations/automation/automation-settings-client.tsx' lib/actions/automation.ts lib/automation/ansible-api.ts lib/automation/ansible-pairing-core.ts lib/automation/ansible-pairing-core.test.mjs lib/automation/ansible-ui-gating.test.mjs lib/actions/mutation-authz.test.mjs tests/e2e/settings/automation.spec.ts
• pnpm --dir apps/web test:unit
• pnpm --dir apps/web test:e2e tests/e2e/settings/automation.spec.ts
• bash deploy/scripts/test-ansible-profile-wiring.sh

Publication follow-up

• After merge, confirm both ghcr.io/carrtech-dev/ct-ops/web and ghcr.io/carrtech-dev/ct-ops/ansible-api publish successfully.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4567ee7777

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep manual setup for env-managed Ansible tokens

This mutation makes pairing the only connection path in the settings UI, but pairing/claim intentionally rejects Ansible APIs that use ANSIBLE_API_SERVICE_TOKEN_ID/SECRET (the server returns “managed by environment”/409). In that legacy-but-supported mode, admins on a fresh CT-Ops instance now have no way in the UI to enter the static token ID/secret and complete onboarding, so connection setup is blocked entirely.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Preserve connection timeout when rotating pairing token

The pairing builder hard-codes timeoutMs to 5000 on every successful pair, so re-pairing silently resets any previously tuned timeout. This can regress existing deployments that raised the timeout for slower links or proxies, because token rotation unexpectedly changes runtime behavior instead of only updating credentials.

Useful? React with 👍 / 👎.