Rename Castle -> Wild PC across the repo

Repo-side rename only (Phases 1-3 of the migration plan); the live box
(~/.castle, systemd units, /data/castle, domains) is a separate cutover.

- Slug `castle` -> `wildpc`: CLI command, module names (wildpc_core/cli/api),
  dist names, entry point `wildpc = wildpc_cli.main:main`.
- Identifiers: CastleConfig/NATSClient/DirError/MDNS -> Wildpc*.
- Env/constants: CASTLE_* -> WILDPC_*; ~/.castle -> ~/.wildpc, castle.yaml ->
  wildpc.yaml, /data/castle -> /data/wildpc.
- Systemd UNIT_PREFIX castle- -> wildpc-; own programs castle-api/gateway/etc.
- Display prose "Castle" -> "Wild PC" in docs, agent-guide files, README, frontend.
- Package dirs and bootstrap yaml renamed via git mv; lockfiles regenerated;
  redundant nested uv.lock files dropped (workspace root lock is authoritative).

Tests: core 273, cli 47, wildpc-api 120 all pass. Frontend type-checks + builds.
Fixed a stale test fixture (secret_env_path kind arg) broken pre-rename.

docs/tunnel-setup.md

@@ -1,6 +1,6 @@
 # Public exposure via Cloudflare Tunnel
 
-Castle is LAN-only by default: services with `proxy: true` are reachable at
+Wild PC is LAN-only by default: services with `proxy: true` are reachable at
 `<name>.<gateway.domain>` (e.g. `<name>.civil.payne.io`) through split DNS, and
 nothing is on the public internet. This document sets up a **per-service public
 toggle** — flip `public: true` on a service and it's also reachable from the public
@@ -17,9 +17,9 @@ internet at `<name>.<gateway.public_domain>`, via a Cloudflare Tunnel.
   Cloudflare (no inbound holes, no public IP needed) and forwards each public
   hostname to the gateway on `:443`, rewriting the Host header and TLS SNI to the
   *internal* name so Caddy routes it and its wildcard cert validates. The public
-  surface is exactly the set of `public: true` services — `castle apply` generates
+  surface is exactly the set of `public: true` services — `wildpc apply` generates
   the ingress from the registry.
-- **One kill switch.** Stop `castle-tunnel` → instantly nothing is public.
+- **One kill switch.** Stop `wildpc-tunnel` → instantly nothing is public.
 
 ```
 foo.pub.payne.io  ──(Cloudflare edge, public cert)──▶  cloudflared (outbound)
@@ -39,22 +39,22 @@ sudo apt-get update && sudo apt-get install -y cloudflared
 
 # 2. Authenticate and create the tunnel (opens a browser to pick the zone)
 cloudflared tunnel login
-cloudflared tunnel create castle          # prints a tunnel UUID + writes creds JSON
+cloudflared tunnel create wildpc          # prints a tunnel UUID + writes creds JSON
 
-# 3. Move the credentials into Castle's secret store (path the generator expects)
-mkdir -p ~/.castle/secrets/cloudflared
+# 3. Move the credentials into Wild PC's secret store (path the generator expects)
+mkdir -p ~/.wildpc/secrets/cloudflared
 TID=<the-uuid-from-step-2>
-mv ~/.cloudflared/$TID.json ~/.castle/secrets/cloudflared/$TID.json
-chmod 600 ~/.castle/secrets/cloudflared/$TID.json
+mv ~/.cloudflared/$TID.json ~/.wildpc/secrets/cloudflared/$TID.json
+chmod 600 ~/.wildpc/secrets/cloudflared/$TID.json
 
-# 4. Tell Castle the public zone + tunnel id (in ~/.castle/castle.yaml)
+# 4. Tell Wild PC the public zone + tunnel id (in ~/.wildpc/wildpc.yaml)
 #    gateway:
 #      ...
 #      public_domain: pub.payne.io
 #      tunnel_id: <the-uuid>
 ```
 
-Then create the tunnel deployment at `~/.castle/deployments/castle-tunnel.yaml`
+Then create the tunnel deployment at `~/.wildpc/deployments/wildpc-tunnel.yaml`
 (`manager: systemd` → kind: service):
 
 ```yaml
@@ -67,7 +67,7 @@ run:
     - tunnel
     - --no-autoupdate
     - --config
-    - /home/payne/.castle/artifacts/specs/cloudflared.yml
+    - /home/payne/.wildpc/artifacts/specs/cloudflared.yml
     - run
 manage:
   systemd: {}
@@ -76,8 +76,8 @@ manage:
 Bring it online:
 
 ```bash
-castle apply                       # writes cloudflared.yml from public services
-castle apply castle-tunnel # start the tunnel
+wildpc apply                       # writes cloudflared.yml from public services
+wildpc apply wildpc-tunnel # start the tunnel
 ```
 
 ## Using the toggle
@@ -92,18 +92,18 @@ public: true     # also expose at <name>.pub.payne.io via the tunnel
 Then just deploy:
 
 ```bash
-castle apply
+wildpc apply
 ```
 
-`castle apply` regenerates `~/.castle/artifacts/specs/cloudflared.yml` from the
-current set of public services and restarts `castle-tunnel`. Flip `public` back to
+`wildpc apply` regenerates `~/.wildpc/artifacts/specs/cloudflared.yml` from the
+current set of public services and restarts `wildpc-tunnel`. Flip `public` back to
 `false` (or remove it) and redeploy to un-expose — the hostname drops out of the
 ingress immediately.
 
 ### DNS: automatic (with a token) or manual
 
 Each public host needs a CNAME `<name>.pub.payne.io → <tunnel>.cfargotunnel.com`.
-Castle can manage these for you. Create a Cloudflare API token with a single
+Wild PC can manage these for you. Create a Cloudflare API token with a single
 **`DNS:Edit`** permission scoped to the **public zone** — this is exactly
 Cloudflare's built-in *"Edit zone DNS"* template. That one permission is
 sufficient: it resolves the zone by name *and* creates/deletes records (no
@@ -112,18 +112,18 @@ token (`cfat_…`) works (that's what this was confirmed with). Drop it into the
 secret store:
 
 ```bash
-printf %s "<token>" > ~/.castle/secrets/CLOUDFLARE_PUBLIC_DNS_TOKEN
-chmod 600 ~/.castle/secrets/CLOUDFLARE_PUBLIC_DNS_TOKEN
+printf %s "<token>" > ~/.wildpc/secrets/CLOUDFLARE_PUBLIC_DNS_TOKEN
+chmod 600 ~/.wildpc/secrets/CLOUDFLARE_PUBLIC_DNS_TOKEN
 ```
 
-With it present, every `castle apply` **reconciles** the public CNAMEs against the
+With it present, every `wildpc apply` **reconciles** the public CNAMEs against the
 current public set — creating missing ones and deleting removed ones — and prints a
 one-line summary. It only ever touches records pointing at *this* tunnel
 (`<tunnel_id>.cfargotunnel.com`), so hand-managed records in the same zone are safe.
 This token is separate from `CLOUDFLARE_API_TOKEN` (which is the ACME token for the
 internal zone); the public zone is usually a different zone/account.
 
-Without the token, `castle apply` instead prints the exact command to run per host:
+Without the token, `wildpc apply` instead prints the exact command to run per host:
 
 ```bash
 cloudflared tunnel route dns <tunnel-id> <name>.pub.payne.io