feat(awooop): enable controlled agent apply

apps/api/src/core/config.py

@@ -613,9 +613,32 @@ class Settings(BaseSettings):
         default=False,
         description=(
             "True=consume ansible_candidate_matched AOL rows and run "
-            "ansible-playbook --check --diff only. Apply remains disabled."
+            "ansible-playbook --check --diff before controlled apply."
         ),
     )
+    ENABLE_AWOOOP_ANSIBLE_CONTROLLED_APPLY: bool = Field(
+        default=True,
+        description=(
+            "True=after a successful check-mode, allow AI Agent controlled Ansible "
+            "apply for allowlisted low/medium/high risk playbooks. Critical, "
+            "secret, destructive, data migration/restore/prune, reboot and node-drain "
+            "routes remain blocked by catalog and guardrails."
+        ),
+    )
+    AWOOOP_ANSIBLE_CONTROLLED_APPLY_ALLOWED_RISK_LEVELS: str = Field(
+        default="low,medium,high",
+        description=(
+            "Comma-separated risk levels that AI Agent may apply after check-mode "
+            "passes. This implements owner direction that low/medium/high are "
+            "automated; critical stays break-glass only."
+        ),
+    )
+    AWOOOP_ANSIBLE_CONTROLLED_APPLY_TIMEOUT_SECONDS: int = Field(
+        default=300,
+        ge=30,
+        le=900,
+        description="Timeout for one controlled ansible-playbook apply execution.",
+    )
     AWOOOP_ANSIBLE_CHECK_MODE_INTERVAL_SECONDS: int = Field(
         default=300,
         ge=60,