api+ui: kind-scoped save/delete endpoints and links

API: /config/{services,jobs,tools,static}/{name} now pin the twin they
target — _save_deployment/_delete_deployment take an explicit kind so a
patch to a 'backup' service can't bleed into a 'backup' job/tool. Add
/tools and /static endpoints; keep /deployments/{name} kind-agnostic.
New test_kind_twins proves per-kind save/delete isolation on disk.

UI: ConfigPanel and CreateDeploymentForm write to the kind-scoped
resource; GatewayPanel/NodeDetail/DeploymentsSection link via a shared
detailPath(name, kind) helper instead of the ambiguous /deployment/:name.

Includes incidental ruff-format reflow of untouched api files.

app/src/lib/labels.ts

@@ -48,6 +48,17 @@ export function stackLabel(stack: string): string {
   return STACK_LABELS[stack] ?? stack
 }
 
+/**
+ * The kind-scoped detail route for a deployment. A name can be shared across
+ * kinds (a `backup` service + job + tool), so links must carry the kind to
+ * reach the right twin. Statics share the service detail page.
+ */
+export function detailPath(name: string, kind: string): string {
+  if (kind === "tool") return `/tools/${name}`
+  if (kind === "job") return `/jobs/${name}`
+  return `/services/${name}`
+}
+
 /**
  * Full URL for a service exposed at <subdomain>.<gateway.domain>. The domain is
  * derived from the dashboard's own host (it is served at castle.<domain>), so