Fix variable deprecations and split site.yml into system and user plays

Replace deprecated ansible_user_dir/ansible_user_id with
ansible_facts['user_dir'/'user_id'] across all roles. Switch git repo
URLs from HTTPS to SSH. Split site.yml into two plays so user-facing
roles (dotfiles, scripts, hotkeys) run without become.

roles/scripts/tasks/main.yml

@@ -1,13 +1,13 @@
 ---
 - name: Clone the scripts repo
   ansible.builtin.git:
-    repo: https://gitea.learningunix.net/cjr/scripts
-    dest: "{{ ansible_user_dir }}/scripts"
+    repo: git@gitea.learningunix.net:cjr/scripts.git
+    dest: "{{ ansible_facts['user_dir'] }}/scripts"
     update: true
     version: main
 
 - name: Ensure that scripts is in the user's path
   ansible.builtin.lineinfile:
-    path: "{{ ansible_user_dir }}/dotfiles/zsh/.zshrc"
+    path: "{{ ansible_facts['user_dir'] }}/dotfiles/zsh/.zshrc"
     line: 'export PATH="$HOME/scripts:$PATH"'
     state: present