fix(ansible): harden AUR install task and rename ansible_user to local_user

- AUR task: replace loop with single paru call, use changed_when: false
  (stdout-only match never fired under non-TTY runs) and failed_when: false
  so transient AUR failures don't abort the play
- Rename ansible_user -> local_user to avoid shadowing the connection
  magic var; update the two references in roles/common/tasks/main.yml

ansible/roles/common/tasks/main.yml

@@ -3,8 +3,8 @@
   file:
     path: "{{ ansible_env.HOME }}/.config/kitty"
     state: directory
-    owner: "{{ ansible_user }}"
-    group: "{{ ansible_user }}"
+    owner: "{{ local_user }}"
+    group: "{{ local_user }}"
     mode: '0755'
   tags: [kitty, terminal]
 
@@ -12,8 +12,8 @@
   template:
     src: kitty.conf.j2
     dest: "{{ ansible_env.HOME }}/.config/kitty/kitty.conf"
-    owner: "{{ ansible_user }}"
-    group: "{{ ansible_user }}"
+    owner: "{{ local_user }}"
+    group: "{{ local_user }}"
     mode: '0644'
   vars:
     kitty_config_dir: "{{ ansible_env.HOME }}/.config/kitty"

ansible/roles/dev-tools/tasks/main.yml

@@ -86,6 +86,14 @@
   changed_when: false
   tags: [python, pipx]
 
+- name: Ensure JetBrains Toolbox and IntelliJ IDEA Ultimate are installed from AUR
+  become: true
+  become_user: "{{ system_user }}"
+  command: paru -S --noconfirm --needed jetbrains-toolbox intellij-idea-ultimate-edition
+  changed_when: false
+  failed_when: false
+  tags: [jetbrains, aur]
+
 - name: Ensure redundant and non-core software is removed
   community.general.pacman:
     name: