Choose how tofupilot run shows the operator UI

Running a procedure on a laptop no longer opens the full-screen kiosk window, and the way the operator UI is shown is one flag instead of a flag and an environment variable.

• Added --ui kiosk|browser|headless to tofupilot run: full screen for a station, a tab in your browser for developing a procedure, or just the printed URL for agents, CI and SSH port-forwards. --no-ui serves no UI.
• Removed --kiosk, --no-kiosk and TOFUPILOT_NO_BROWSER; scripts using them must switch to --ui and --no-ui.
• Changed local-path runs to follow their flags only: they no longer inherit the station's kiosk and terminal UI settings on a machine that is also a station. Deployment runs and the station service still follow the dashboard settings.
• Fixed a station running as a root service opening its own operator UI server for every run.