Fix variable deprecations and split site.yml into system and user plays

Replace deprecated ansible_user_dir/ansible_user_id with
ansible_facts['user_dir'/'user_id'] across all roles. Switch git repo
URLs from HTTPS to SSH. Split site.yml into two plays so user-facing
roles (dotfiles, scripts, hotkeys) run without become.

roles/docker/tasks/main.yml

@@ -14,6 +14,6 @@
 
 - name: Add user to docker group
   ansible.builtin.user:
-    user: "{{ ansible_user_id }}"
+    user: "{{ ansible_facts['user_id'] }}"
     groups: docker
     append: true