kind is a deployment property, not a program property

A program has no single kind — it HAS deployments, each with its own kind (a
program can be a tool AND a job, e.g. protonmail). Remove program-level kind:

- core: drop ProgramSpec.kind; CastleConfig.kind_of → deployments_of(name) →
  [(deployment-name, kind)]; tools property derives from a tool deployment.
- api: ProgramSummary drops kind/services/jobs → deployments: [{name, kind}];
  /programs?kind= filters by deployment-kind membership; a program's legacy
  DeploymentSummary carries kind=None.
- cli: list/info show a program's set of deployment kinds; --kind filters by
  membership.

Also: Services page now covers statics — /services returns kind in
{service, static} (both are exposed, URL-reachable 'services', caddy vs systemd),
and ServiceSummary gains kind + manager to distinguish them.

Suites: core 124, cli 25, castle-api 58.

cli/tests/test_add.py

@@ -42,10 +42,10 @@ class TestAdd:
         )
         rc, config = _run_add(castle_root, target=str(repo))
         assert rc == 0
-        # `add` adopts source only (kind is derived from a deployment declared
-        # later); a fastapi project is detected as the python-fastapi stack.
+        # `add` adopts source only — no deployment yet (kind is a deployment
+        # property); a fastapi project is detected as the python-fastapi stack.
         assert config.programs["svc"].stack == "python-fastapi"
-        assert config.programs["svc"].kind is None
+        assert config.deployments_of("svc") == []
 
     def test_adopt_rust_declares_commands(self, castle_root: Path, tmp_path: Path) -> None:
         repo = tmp_path / "rusty"

cli/tests/test_create.py

@@ -73,10 +73,9 @@ class TestCreateCommand:
         assert (project_dir / "src" / "my_tool2" / "main.py").exists()
         assert (project_dir / "CLAUDE.md").exists()
         assert "my-tool2" in config.programs
-        comp = config.programs["my-tool2"]
-        assert comp.kind == "tool"
-        # A tool is a PATH deployment: manager=path.
+        # A tool is a PATH deployment: manager=path, derived kind=tool.
         assert config.deployments["my-tool2"].manager == "path"
+        assert config.deployments_of("my-tool2") == [("my-tool2", "tool")]
 
     def test_create_supabase_app(self, castle_root: Path, tmp_path: Path) -> None:
         """A supabase app scaffolds a Patch-shaped project registered as a static
@@ -106,12 +105,12 @@ class TestCreateCommand:
 
         # Registered as a program + a caddy (static) deployment serving public/
         comp = config.programs["guestbook"]
-        assert comp.kind == "static"
         assert comp.stack == "supabase"
         assert comp.build is not None and comp.build.outputs == ["public"]
         dep = config.deployments["guestbook"]
         assert dep.manager == "caddy"
         assert dep.root == "public"
+        assert config.deployments_of("guestbook") == [("guestbook", "static")]
 
     def test_create_duplicate_fails(self, castle_root: Path, capsys: object) -> None:
         """Creating a project with existing name fails."""

cli/tests/test_list.py

@@ -89,7 +89,7 @@ class TestListCommand:
         assert "test-svc" in names
         assert "test-tool" in names
         svc = next(p for p in data if p["name"] == "test-svc")
-        assert svc["kind"] == "service"
-        # test-tool is a program deployed on PATH → its derived kind is `tool`.
+        assert svc["kind"] == "service"  # a service deployment entry (singular)
+        # test-tool is a program with a PATH deployment → kinds includes `tool`.
         tool = next(p for p in data if p["name"] == "test-tool")
-        assert tool["kind"] == "tool"
+        assert "tool" in tool["kinds"]