Use self-contained private switch config

[cnberry]

What changed

• use /usr/local/config/switchctl/config.json by default
• store Tuya local keys in the secure private config instead of credential environment variables
• replace the pipx installer with an isolated system environment under /usr/local/lib/home-ops/ctls
• update examples, the skill, runbook, protocol notes, troubleshooting, and tests

Why

A bootstrap-installed inventory containing only local_key_env references was unusable in normal Strawberry login sessions.

Validation

• Ruff format and lint
• detect-secrets baseline scan
• 25 unit tests
• live switchctl on patio-lights --yes plus post-write readback on Strawberry