Edit: to answer your actual question, you can't do it from anywhere except Recovery Mode, so anything you do must be done from there.

Tested on a similar 4,1 upgraded to 5,1 [but I have a flashed graphics card so I could see what I was doing]

Reboot & at the chimes hold Cmd ⌘ R for about 10s.
Wait until you get to Recovery Mode, which for me took approx 45s from the chimes [I'm on SSD but I think it may have chosen a Recovery on another HD to actually boot from] Give it a minute or so just to be safe.

Fn Ctrl ⌃ F2 will switch focus to the menu bar, specifically the Apple logo, top left.

It appears that whatever you have set in System Prefs > Keyboard for "Use all F1, F2 keys as standard function keys" that this option is disabled in Recovery, so even though just Ctrl ⌃ F2 works for me in a running OS, in Recovery I needed the added Fn key.

From there, you can navigate using the arrow keys

Pic from https://apple.stackexchange.com/a/254167/85275

From that you can see that Terminal is 4 to the right, then 4 down.
It's 4 not 3 because the first down arrow opens the menu.

Hit Enter & Terminal will launch.
Type csrutil disable & hit Enter
Type reboot & hit Enter.

If it reboots, you got it right - otherwise you'll have to have another guess.

BTW, golden rule, as you have discovered, is keep your crappy old stock Apple card somewhere safe, for occasions such as this ;-)

Additional note: Fn Ctrl ⌃ F2 is a toggle. First will select the menu bar, second will deselect, so make sure to only do it once.

Note: disabling System Integrity Protection is dangerous, and makes your system more vulnerable to malware.

As Apple puts it in the developer documentation about SIP:

Warning

Disable SIP only temporarily to perform necessary tasks, and reenable it as soon as possible. Failure to reenable SIP when you are done testing leaves your computer vulnerable to malicious code.

If you are simply trying to configure system development tools such as vim, python2, ruby and so on, you almost certainly want to be just installing community-maintained versions from Homebrew and configuring those instead. The system-provided tools may be convenient to bootstrap, but if you require SIP exceptions for your daily workflow you are almost certainly doing things in a way which will break in a future version of the operating system, and may break applications and other system functionality in the meanwhile.

Valid reasons to disable SIP yourself might be:

• if you're doing research on malware yourself in a disposable environment, such as in a macOS virtual machine
• if you are attempting to modify core operating system functionality for deployment in a highly-specialized environment such as a public-facing kiosk
• if you require a legacy kernel extension such as MacFUSE on an M1 mac

Also important beyond the security implications is the fact that anything you do on a mac with SIP disabled will not work on anyone else's mac unless they also disable it first. If you're developing mac apps, then your system becomes less useful as a testbed because you don't know if your code only works because you hacked your system. If you're developing for another platform such as deployment to a web server, then you can't share your development environment setup with other developers on your team without compromising their security as well.

Here's how to do it if you really need to:

Apple's documentation covers disabling SIP, About System Integrity Protection on your Mac and Configuring System Integrity Protection.

An article on lifehacker.com lists these steps:

1. Reboot your Mac into Recovery Mode by restarting your computer and holding down Command+R until the Apple logo appears on your screen.
2. Click Utilities > Terminal.
3. In the Terminal window, type in csrutil disable and press Enter.
4. Restart your Mac.

You can verify whether a file or folder is restricted by issuing this ls command using the capital O (and not zero 0) to modify the long listing flag:

ls -lO /System /usr 

Look for the restricted text to indicate where SIP is enforced.

By default (=SIP enabled), the following folders are restricted (see Apple Support page):

/System
/usr
/bin
/sbin
Apps that are pre-installed with OS X

... and the following folders are free:

/Applications
/Library
/usr/local