kind is a deployment property, not a program property

A program has no single kind — it HAS deployments, each with its own kind (a
program can be a tool AND a job, e.g. protonmail). Remove program-level kind:

- core: drop ProgramSpec.kind; CastleConfig.kind_of → deployments_of(name) →
  [(deployment-name, kind)]; tools property derives from a tool deployment.
- api: ProgramSummary drops kind/services/jobs → deployments: [{name, kind}];
  /programs?kind= filters by deployment-kind membership; a program's legacy
  DeploymentSummary carries kind=None.
- cli: list/info show a program's set of deployment kinds; --kind filters by
  membership.

Also: Services page now covers statics — /services returns kind in
{service, static} (both are exposed, URL-reachable 'services', caddy vs systemd),
and ServiceSummary gains kind + manager to distinguish them.

Suites: core 124, cli 25, castle-api 58.

castle-api/tests/test_health.py

@@ -203,12 +203,14 @@ class TestProgramsList:
         names = [p["id"] for p in data]
         assert "test-tool" in names
 
-    def test_program_has_kind(self, client: TestClient) -> None:
-        """Program summary includes the derived kind."""
+    def test_program_lists_deployments(self, client: TestClient) -> None:
+        """Program summary lists its deployments (name + kind), not a single kind."""
         response = client.get("/programs")
         data = response.json()
         tool = next(p for p in data if p["id"] == "test-tool")
-        assert tool["kind"] == "tool"
+        assert "kind" not in tool
+        kinds = {d["kind"] for d in tool["deployments"]}
+        assert "tool" in kinds
 
     def test_no_port_field(self, client: TestClient) -> None:
         """ProgramSummary does not have port field."""
@@ -235,7 +237,7 @@ class TestProgramDetail:
         data = response.json()
         assert data["id"] == "test-tool"
         assert "manifest" in data
-        assert data["kind"] == "tool"
+        assert {d["kind"] for d in data["deployments"]} == {"tool"}
 
     def test_not_found(self, client: TestClient) -> None:
         """Returns 404 for unknown program."""