[#385] ssh_ca role + onboarding playbook (fleet SSH cert CA rollout)

Idempotent role: install fleet User CA public key + TrustedUserCAKeys
drop-in, validate sshd -t, reload. Sectestbed wave first, prod under CR.
https://projects.knownelement.com/issues/385

roles/ssh_ca/defaults/main.yml

@@ -0,0 +1,6 @@
+---
+# ssh_ca role defaults [#385]
+ssh_ca_key_src: fleet_user_ca.pub          # role file (public key only)
+ssh_ca_key_dest: /etc/ssh/fleet_user_ca.pub
+ssh_ca_dropin: /etc/ssh/sshd_config.d/99-fleet-ca.conf
+ssh_ca_trusted_line: "TrustedUserCAKeys /etc/ssh/fleet_user_ca.pub"

roles/ssh_ca/files/fleet_user_ca.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHtlhPfNlm/6bJqPRQv7jsrt1sMUTKgAAwUh0yZCESNU KNEL Fleet SSH User CA

roles/ssh_ca/meta/main.yml

@@ -0,0 +1,12 @@
+---
+galaxy_info:
+  author: KNEL OAM lane
+  description: Onboard host to the fleet SSH certificate CA (TrustedUserCAKeys)
+  license: AGPL-3.0-or-later
+  min_ansible_version: "2.14"
+  platforms:
+    - name: Debian
+      versions: [bookworm, trixie]
+    - name: Ubuntu
+      versions: [noble]
+dependencies: []

roles/ssh_ca/tasks/main.yml

@@ -0,0 +1,25 @@
+---
+# ssh_ca — onboard a host to the fleet SSH certificate CA [#385]
+# Idempotent: installs the public User CA + TrustedUserCAKeys drop-in.
+# Private CA keys NEVER come from the control node.
+- name: install fleet user CA public key
+  ansible.builtin.copy:
+    src: "{{ ssh_ca_key_src }}"
+    dest: "{{ ssh_ca_key_dest }}"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: reload sshd
+
+- name: install TrustedUserCAKeys drop-in
+  ansible.builtin.copy:
+    dest: "{{ ssh_ca_dropin }}"
+    content: "{{ ssh_ca_trusted_line }}\n"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: reload sshd
+
+- name: validate sshd config
+  ansible.builtin.command: sshd -t
+  changed_when: false