Use self-contained private hot tub config

[cnberry]

What changed

• use /usr/local/config/hottubctl/config.json as the primary default
• read SmartTub username and password from the secure private config instead of credential environment variables
• replace the pipx installer with an isolated system environment under /usr/local/lib/home-ops/ctls
• update security guidance, examples, troubleshooting, and tests

Why

The home-ops bootstrap should produce a complete usable installation without requiring shell-specific credential setup.

Validation

• Ruff format and lint
• detect-secrets baseline scan
• 8 unit tests
• live read-only Strawberry temperature/status check