custom: add northwatch play to install and configure Northwatch

[berendt]

Summary

• Add a custom Ansible play playbook-northwatch.yml that installs
  Northwatch as a .deb package
  on the manager and configures it to browse, debug and monitor the
  testbed's OVN control plane.
• This is the config-file equivalent of Northwatch's make testbed target:
  the OVN Northbound/Southbound addresses (the three control nodes,
  comma-separated for Raft failover) and the OpenStack enrichment
  credentials (mirroring the admin cloud in environments/openstack/clouds.yml)
  are rendered into /etc/northwatch/clusters.json, and the shipped
  northwatch.service is driven via /etc/default/northwatch.
• The second play configures the OVSDB managers (TCP listener on port 6640,
  on 127.0.0.1 and the node's internal management address) on all Open
  vSwitch nodes for per-chassis OVS visibility — guarded by the presence of
  the openvswitch_db container and made idempotent via a get-manager
  comparison. This is folded in from custom: add ovs-manager play to configure OVSDB managers #2920, so custom: add ovs-manager play to configure OVSDB managers #2920 can be closed.

Relationship to #2920

The OVS-manager logic is identical to #2920 (hosts: network:compute,
openvswitch_db, dual ptcp:6640:127.0.0.1 + ptcp:6640:{{ internal_address }}
listeners, container guard, idempotent compare), so this play supersedes it.

One behavioural difference: #2920 also wired the ovs-manager play into
scripts/deploy-services.sh to run on every deploy. Here it runs on demand
as part of the Northwatch play (gated by northwatch_ovs_enabled), so the
OVSDB TCP listeners are only opened when Northwatch is actually set up. If we
want the managers configured on every deploy independent of Northwatch, that
one-line hook can be added back separately.

Notes

• Pinned to northwatch_version: "0.5.0" (with a renovate: annotation). The
  install task downloads northwatch_${version}_${arch}.deb from the GitHub
  releases; this requires v0.5.0 to be published.
• Northwatch has no built-in authentication; the dashboard/API listens on
  :8080 on the manager and is meant to be reached over the WireGuard/sshuttle
  VPN or an SSH tunnel.
• Everything is overridable via play vars (version, listen address, write
  enable, OVS visibility toggle, credentials).

Test plan

osism apply --environment custom playbook-northwatch

🤖 Generated with Claude Code