Rename Castle -> Wild PC across the repo

Repo-side rename only (Phases 1-3 of the migration plan); the live box
(~/.castle, systemd units, /data/castle, domains) is a separate cutover.

- Slug `castle` -> `wildpc`: CLI command, module names (wildpc_core/cli/api),
  dist names, entry point `wildpc = wildpc_cli.main:main`.
- Identifiers: CastleConfig/NATSClient/DirError/MDNS -> Wildpc*.
- Env/constants: CASTLE_* -> WILDPC_*; ~/.castle -> ~/.wildpc, castle.yaml ->
  wildpc.yaml, /data/castle -> /data/wildpc.
- Systemd UNIT_PREFIX castle- -> wildpc-; own programs castle-api/gateway/etc.
- Display prose "Castle" -> "Wild PC" in docs, agent-guide files, README, frontend.
- Package dirs and bootstrap yaml renamed via git mv; lockfiles regenerated;
  redundant nested uv.lock files dropped (workspace root lock is authoritative).

Tests: core 273, cli 47, wildpc-api 120 all pass. Frontend type-checks + builds.
Fixed a stale test fixture (secret_env_path kind arg) broken pre-rename.

app/src/services/api/client.ts

@@ -1,6 +1,6 @@
-// Resolve the castle-api base URL. The gateway serves each service at its own
-// subdomain (<name>.<domain>), so when the dashboard runs at castle.<domain>
-// the API lives at castle-api.<domain> — a cross-origin call (castle-api allows
+// Resolve the wildpc-api base URL. The gateway serves each service at its own
+// subdomain (<name>.<domain>), so when the dashboard runs at wildpc.<domain>
+// the API lives at wildpc-api.<domain> — a cross-origin call (wildpc-api allows
 // CORS *). When served at a bare host (dev, or the off-mode :9000 gateway), the
 // API is reachable same-origin at /api.
 function resolveApiBase(): string {
@@ -10,7 +10,7 @@ function resolveApiBase(): string {
     const { protocol, hostname } = window.location
     const labels = hostname.split(".")
     if (labels.length > 2) {
-      return `${protocol}//castle-api.${labels.slice(1).join(".")}`
+      return `${protocol}//wildpc-api.${labels.slice(1).join(".")}`
     }
   }
   return "/api"
@@ -78,7 +78,7 @@ class ApiClient {
   }
 
   // Build a ws(s):// URL for a WebSocket endpoint. Handles both the cross-origin
-  // base (https://castle-api.<domain>) and the same-origin "/api" base.
+  // base (https://wildpc-api.<domain>) and the same-origin "/api" base.
   wsUrl(path: string): string {
     const absolute = this.baseUrl.startsWith("http")
       ? `${this.baseUrl}${path}`