Fix variable deprecations and split site.yml into system and user plays

Replace deprecated ansible_user_dir/ansible_user_id with
ansible_facts['user_dir'/'user_id'] across all roles. Switch git repo
URLs from HTTPS to SSH. Split site.yml into two plays so user-facing
roles (dotfiles, scripts, hotkeys) run without become.

roles/virtualization/tasks/main.yml

@@ -15,6 +15,6 @@
 
 - name: Add user to libvirt group
   ansible.builtin.user:
-    name: "{{ ansible_user_id }}"
+    name: "{{ ansible_facts['user_id'] }}"
     groups: libvirt
     append: true