added multica agent hosts

ansible/roles/multica_agent_host/tasks/auth.yml

@@ -0,0 +1,44 @@
+---
+# `multica auth status` prints the server and user when authenticated and exits
+# non-zero otherwise, so it is the idempotency guard for login.
+- name: Auth | Read the current authentication state
+  ansible.builtin.command:
+    argv: "{{ _multica_cmd + ['auth', 'status'] }}"
+  become: true
+  become_user: "{{ multica_user }}"
+  environment: "{{ _multica_user_env }}"
+  register: _multica_auth_status
+  changed_when: false
+  failed_when: false
+  check_mode: false
+
+- name: Auth | Decide whether a login is needed
+  ansible.builtin.set_fact:
+    _multica_needs_login: >-
+      {{ multica_force_relogin | bool
+         or _multica_auth_status.rc != 0
+         or multica_server_url.rstrip('/') not in (_multica_auth_status.stdout | default('')) }}
+
+# no_log is mandatory: without it Ansible records the full argv — including the
+# PAT — in play output, CI logs, and every callback plugin.
+- name: Auth | Log in with the personal access token
+  ansible.builtin.command:
+    argv: "{{ _multica_cmd + ['login', '--token', multica_pat] }}"
+  become: true
+  become_user: "{{ multica_user }}"
+  environment: "{{ _multica_user_env }}"
+  when: _multica_needs_login | bool
+  changed_when: true
+  no_log: true
+  notify: restart multica daemon
+
+- name: Auth | Pin the default workspace
+  ansible.builtin.command:
+    argv: "{{ _multica_cmd + ['workspace', 'switch', multica_workspace_id] }}"
+  become: true
+  become_user: "{{ multica_user }}"
+  environment: "{{ _multica_user_env }}"
+  when: multica_workspace_id | length > 0
+  register: _multica_ws_switch
+  changed_when: _multica_needs_login | bool
+  notify: restart multica daemon