Fix become-precedence bug, dead Tailscale install path, and make meshcore config self-sufficient

- ansible_become: true as a group_vars connection variable silently took
  precedence over every task-level `become: false` in this repo, so
  every "unprivileged" task (pipx installs, user script deploys,
  legacy .env.local writes) was actually running as root the whole
  time. Move become to a play-level keyword in site.yml instead, which
  correctly loses to a task's own become: false. Also stop relying on
  ansible_env.HOME (which reflected root's home once facts were
  gathered under the old broken setup) and use /home/{{ remote_user }}
  directly, with explicit owner/group so ownership self-heals.
- meshcore_capture: 99-user.toml.j2 now defines every broker
  (including letsmesh-us/eu) fully rather than assuming
  config.d/10-letsmesh.toml was auto-installed — that preset only gets
  created on some install paths (fresh install) and not others
  (migrate), so the old partial-override form silently dropped
  brokers on migrated nodes.
- base: install libffi-dev/pkg-config on armv6 (Pi Zero W) — cffi has
  no prebuilt wheel for that architecture and fails to compile
  without the headers.
- dm-ashwell: migrated off the legacy layout to the current
  installer's system-service layout; drop its layout override now
  that it matches the group default.
- meshcore-capture-update.sh: fix a YAML folded scalar (>-) collapsing
  the shebang and command onto one line, corrupting the script.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

ansible/roles/base/tasks/main.yml

@@ -17,6 +17,15 @@
     state: present
   become: true
 
+- name: Install libffi headers (armv6 has no prebuilt cffi wheel, needs to compile it)
+  apt:
+    name:
+      - libffi-dev
+      - pkg-config
+    state: present
+  become: true
+  when: ansible_architecture == "armv6l"
+
 - name: Set MOTD
   template:
     src: motd.j2