ansible: implement install + policy + pending tasks

Adds the apt_repository / apt steps that pull authforge-daemon, -pam,
and -cli (with -gui gated behind authforge_install_gui), the template
step that renders /etc/authforge/policy.d/90-fleet.conf and notifies the
restart handler, and a loop that calls `authforgectl pending set` for
each entry in authforge_pending_users.

The template emits TOML that round-trips through tomllib for both the
empty-stacks default and a populated multi-stack config.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ansible-role/templates/policy.conf.j2

@@ -0,0 +1,18 @@
+# {{ ansible_managed }}
+# Fleet-managed AuthForge policy. Hand-edits will be overwritten on the next
+# Ansible run. To override locally, drop a higher-numbered file in
+# /etc/authforge/policy.d/ (e.g. 99-local.conf).
+
+{% for stack, cfg in authforge_stacks.items() %}
+[stacks.{{ stack }}]
+mode = "{{ cfg.mode }}"
+methods = {{ cfg.methods | to_json }}
+
+{% endfor %}
+[storage]
+backend = "{{ authforge_storage_backend }}"
+central_path = "{{ authforge_storage_central_path }}"
+
+[firstrun]
+default_required_methods = {{ authforge_firstrun_methods | to_json }}
+deadline_hours = {{ authforge_firstrun_deadline_hours }}