api+ui: kind-scoped save/delete endpoints and links

API: /config/{services,jobs,tools,static}/{name} now pin the twin they
target — _save_deployment/_delete_deployment take an explicit kind so a
patch to a 'backup' service can't bleed into a 'backup' job/tool. Add
/tools and /static endpoints; keep /deployments/{name} kind-agnostic.
New test_kind_twins proves per-kind save/delete isolation on disk.

UI: ConfigPanel and CreateDeploymentForm write to the kind-scoped
resource; GatewayPanel/NodeDetail/DeploymentsSection link via a shared
detailPath(name, kind) helper instead of the ambiguous /deployment/:name.

Includes incidental ruff-format reflow of untouched api files.

castle-api/tests/test_nodes.py

@@ -31,7 +31,9 @@ class TestNodesList:
         assert local["deployed_count"] == 2  # test-svc + test-tool
         assert local["service_count"] == 1  # only test-svc is a service
 
-    def test_includes_remote_nodes(self, client: TestClient, registry_path: Path) -> None:
+    def test_includes_remote_nodes(
+        self, client: TestClient, registry_path: Path
+    ) -> None:
         """Remote nodes from mesh state are included."""
         import castle_api.mesh as mesh_mod
 
@@ -42,7 +44,8 @@ class TestNodesList:
                 node=NodeConfig(hostname="devbox", gateway_port=9000),
                 deployed={
                     "remote-svc": Deployment(
-                        manager="systemd", launcher="python",
+                        manager="systemd",
+                        launcher="python",
                         run_cmd=["svc"],
                         port=9050,
                         kind="service",