Fix variable deprecations and split site.yml into system and user plays

Replace deprecated ansible_user_dir/ansible_user_id with
ansible_facts['user_dir'/'user_id'] across all roles. Switch git repo
URLs from HTTPS to SSH. Split site.yml into two plays so user-facing
roles (dotfiles, scripts, hotkeys) run without become.

roles/hotkeys/tasks/main.yml

@@ -2,18 +2,18 @@
 - name: Copy cheat sheet desktop file
   ansible.builtin.template:
     src: cheat-sheet.desktop.j2
-    dest: "{{ ansible_user_dir }}/.local/share/applications/net.local.cheat-sheet.sh.desktop"
+    dest: "{{ ansible_facts['user_dir'] }}/.local/share/applications/net.local.cheat-sheet.sh.desktop"
     mode: "0644"
 
 - name: Copy password script
   ansible.builtin.template:
     src: pass-menu.desktop.j2
-    dest: "{{ ansible_user_dir }}/.local/share/applications/net.local.pass-menu.sh.desktop"
+    dest: "{{ ansible_facts['user_dir'] }}/.local/share/applications/net.local.pass-menu.sh.desktop"
     mode: "0644"
 
 - name: Set cheat-sheet hotkey
   community.general.ini_file:
-    path: "{{ ansible_user_dir }}/.config/kglobalshortcutsrc"
+    path: "{{ ansible_facts['user_dir'] }}/.config/kglobalshortcutsrc"
     section: "services][net.local.cheat-sheet.sh.desktop"
     option: _launch
     value: Alt+C
@@ -21,7 +21,7 @@
 
 - name: Set pass-menu hotkey
   community.general.ini_file:
-    path: "{{ ansible_user_dir }}/.config/kglobalshortcutsrc"
+    path: "{{ ansible_facts['user_dir'] }}/.config/kglobalshortcutsrc"
     section: "services][net.local.pass-menu.sh.desktop"
     option: _launch
     value: Alt+P