How do you setup sshd with ansible? You need some form of access for initial provisioning, Ansible doesn't fix that either.

Sure, you can take that manually configured sshd and replace it with something managed by ansible _after_ the initial setup, but not before.