feat: add ansible to base cli-tools

Adds ansible + ansible-lint as an always-on base module so it is
available in both identities (private/work) and all contexts.
Disable per host via base.cliTools.ansible.enable = false.

profiles/base/cli-tools/ansible.nix

@@ -0,0 +1,21 @@
+# Ansible — configuration management for rolling out configurations to servers.
+# Lives in base so it is available in every identity (private/work) and context.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.base.cliTools.ansible;
+in {
+  # Enabled by default — base modules are always-on.
+  options.base.cliTools.ansible.enable = (mkEnableOption "enable Ansible configuration management") // {default = true;};
+
+  config = mkIf cfg.enable {
+    home.packages = with pkgs; [
+      ansible
+      ansible-lint
+    ];
+  };
+}