api+ui: kind-scoped save/delete endpoints and links

API: /config/{services,jobs,tools,static}/{name} now pin the twin they
target — _save_deployment/_delete_deployment take an explicit kind so a
patch to a 'backup' service can't bleed into a 'backup' job/tool. Add
/tools and /static endpoints; keep /deployments/{name} kind-agnostic.
New test_kind_twins proves per-kind save/delete isolation on disk.

UI: ConfigPanel and CreateDeploymentForm write to the kind-scoped
resource; GatewayPanel/NodeDetail/DeploymentsSection link via a shared
detailPath(name, kind) helper instead of the ambiguous /deployment/:name.

Includes incidental ruff-format reflow of untouched api files.

castle-api/tests/test_mqtt.py

@@ -9,7 +9,9 @@ from castle_api.mqtt_client import _json_to_registry, _registry_to_json
 
 def _make_registry() -> NodeRegistry:
     return NodeRegistry(
-        node=NodeConfig(hostname="tower", castle_root="/data/repos/castle", gateway_port=9000),
+        node=NodeConfig(
+            hostname="tower", castle_root="/data/repos/castle", gateway_port=9000
+        ),
         deployed={
             "my-svc": Deployment(
                 manager="systemd",
@@ -80,7 +82,9 @@ class TestRegistrySerialization:
         reg = NodeRegistry(
             node=NodeConfig(hostname="minimal"),
             deployed={
-                "bare": Deployment(manager="systemd", launcher="command", run_cmd=["bare"], name="bare"),
+                "bare": Deployment(
+                    manager="systemd", launcher="command", run_cmd=["bare"], name="bare"
+                ),
             },
         )
         restored = _json_to_registry(_registry_to_json(reg))