Fix variable deprecations and split site.yml into system and user plays

Replace deprecated ansible_user_dir/ansible_user_id with
ansible_facts['user_dir'/'user_id'] across all roles. Switch git repo
URLs from HTTPS to SSH. Split site.yml into two plays so user-facing
roles (dotfiles, scripts, hotkeys) run without become.

roles/dotfiles/tasks/main.yml

@@ -1,28 +1,28 @@
 ---
 - name: Clone dot files repo
   ansible.builtin.git:
-    repo: https://gitea.learningunix.net/cjr/dotfiles.git
-    dest: "{{ ansible_user_dir }}/dotfiles"
+    repo: git@gitea.learningunix.net:cjr/dotfiles.git
+    dest: "{{ ansible_facts['user_dir'] }}/dotfiles"
     update: true
     version: main
 
 - name: Clone the nvim repo
   ansible.builtin.git:
-    repo: https://gitea.learningunix.net/cjr/vim.git
-    dest: "{{ ansible_user_dir }}/nvim"
+    repo: git@gitea.learningunix.net:cjr/vim.git
+    dest: "{{ ansible_facts['user_dir'] }}/nvim"
     update: true
     version: main
 
 - name: Symlink .zshrc
   ansible.builtin.file:
-    src: "{{ ansible_user_dir }}/dotfiles/zsh/.zshrc"
-    dest: "{{ ansible_user_dir }}/.zshrc"
+    src: "{{ ansible_facts['user_dir'] }}/dotfiles/zsh/.zshrc"
+    dest: "{{ ansible_facts['user_dir'] }}/.zshrc"
     state: link
     force: true
 
 - name: Symlink nvim config
   ansible.builtin.file:
-    src: "{{ ansible_user_dir }}/nvim"
-    dest: "{{ ansible_user_dir }}/.config/nvim"
+    src: "{{ ansible_facts['user_dir'] }}/nvim"
+    dest: "{{ ansible_facts['user_dir'] }}/.config/nvim"
     state: link
     force: true