ansible: implement install + policy + pending tasks

Adds the apt_repository / apt steps that pull authforge-daemon, -pam,
and -cli (with -gui gated behind authforge_install_gui), the template
step that renders /etc/authforge/policy.d/90-fleet.conf and notifies the
restart handler, and a loop that calls `authforgectl pending set` for
each entry in authforge_pending_users.

The template emits TOML that round-trips through tomllib for both the
empty-stacks default and a populated multi-stack config.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ansible-role/tasks/main.yml

@@ -0,0 +1,52 @@
+---
+- name: Add the AuthForge PPA
+  ansible.builtin.apt_repository:
+    repo: "{{ authforge_ppa }}"
+    state: present
+    update_cache: true
+
+- name: Install AuthForge headless components
+  ansible.builtin.apt:
+    name:
+      - authforge-daemon
+      - authforge-pam
+      - authforge-cli
+    state: present
+    update_cache: true
+
+- name: Install AuthForge GUI (optional)
+  ansible.builtin.apt:
+    name: authforge-gui
+    state: present
+  when: authforge_install_gui | bool
+
+- name: Ensure /etc/authforge/policy.d exists
+  ansible.builtin.file:
+    path: /etc/authforge/policy.d
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Render fleet policy file
+  ansible.builtin.template:
+    src: policy.conf.j2
+    dest: /etc/authforge/policy.d/90-fleet.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart authforge-daemon
+
+- name: Mark users as pending-enrollment
+  ansible.builtin.command:
+    argv:
+      - authforgectl
+      - pending
+      - set
+      - "{{ item.user }}"
+      - --methods
+      - "{{ item.methods | join(',') }}"
+  loop: "{{ authforge_pending_users }}"
+  loop_control:
+    label: "{{ item.user }}"
+  changed_when: true

ansible-role/templates/policy.conf.j2

@@ -0,0 +1,18 @@
+# {{ ansible_managed }}
+# Fleet-managed AuthForge policy. Hand-edits will be overwritten on the next
+# Ansible run. To override locally, drop a higher-numbered file in
+# /etc/authforge/policy.d/ (e.g. 99-local.conf).
+
+{% for stack, cfg in authforge_stacks.items() %}
+[stacks.{{ stack }}]
+mode = "{{ cfg.mode }}"
+methods = {{ cfg.methods | to_json }}
+
+{% endfor %}
+[storage]
+backend = "{{ authforge_storage_backend }}"
+central_path = "{{ authforge_storage_central_path }}"
+
+[firstrun]
+default_required_methods = {{ authforge_firstrun_methods | to_json }}
+deadline_hours = {{ authforge_firstrun_deadline_hours }}