feat(automation): add feature flags and ansible provider foundation

[simonjcarr]

Summary

• add DB-backed feature flag overrides via instance_settings.metadata.featureFlags, with a typed code registry and public /api/features endpoint
• add Ansible automation settings/status UI plus backend actions that persist automation.ansible and automationSettings.provider
• add optional ansible-api foundation service, Compose profile wiring, start-script DB selection, docs, and release/CI image publishing support

Validation

• node --experimental-strip-types --test apps/web/lib/feature-flags.test.mjs apps/web/lib/automation/settings-core.test.mjs apps/web/lib/db/schema/metadata-validation.test.mjs apps/web/lib/actions/mutation-authz.test.mjs
• pnpm --filter web type-check
• pnpm --filter web lint (passes with existing warnings)
• DATABASE_URL=postgresql://dummy:dummy@localhost:5432/dummy BETTER_AUTH_SECRET=dummy-secret-for-ci-build-only-at-least-32 BETTER_AUTH_URL=http://localhost:3000 NEXT_PUBLIC_APP_URL=http://localhost:3000 pnpm --filter web run build
• pnpm --filter @ct-ops/docs build
• PYTHONPATH=apps/ansible-api python3 -m unittest discover -s apps/ansible-api/tests
• bash deploy/scripts/test-start.sh
• bash deploy/scripts/test-ansible-profile-wiring.sh
• POSTGRES_PASSWORD=x BETTER_AUTH_SECRET=x docker compose -f docker-compose.single.yml --profile ansible config --services
• release-bundle image replacement simulation with docker compose --profile ansible config --images
• git diff --check

Notes

• pnpm --filter web test:unit was run after installing dependencies and all non-container tests passed, but the existing CT-CVE db-nonce-store Testcontainers test failed locally with Could not find a working container runtime strategy because Docker is not available in this environment.
• Local docker build -q apps/ansible-api could not run because the Docker daemon is not running; CI now includes an Ansible API Docker image build check.