Manager-first deployment model: split runner, merge service/job, frontend→static

Replace the conflated `runner` axis with two orthogonal ones: `manager`
(systemd|caddy|path|none) — who supervises/realizes a deployment — and, for
systemd only, a nested `launcher` (python|command|container|compose|node) — how
the process starts. ServiceSpec and JobSpec collapse into one manager-
discriminated DeploymentSpec union (Systemd/Caddy/Path/Remote); the services/
and jobs/ config dirs collapse into one deployments/ dir. The human "kind"
(service|job|tool|static|reference) is fully derived (kind_for), never stored —
the frontend kind is renamed static. behavior is gone.

- core: DeploymentSpec union + LaunchSpec + kind_for; legacy-aware loader
  normalizes old runner shapes; CastleConfig.deployments with derived
  services/jobs/tools views; registry.Deployment carries manager/launcher/kind.
- cli: service/job/tool as filtered views + a deployment group; --behavior→--kind,
  create --runner→--launcher; lifecycle dispatches over config.deployments.
- castle-api: /deployments primary with /services,/jobs as views; summaries
  derive kind; PUT/DELETE /config/deployments/{name} (services/jobs aliased).
- app: KindBadge, frontend→static everywhere, pick-a-kind creation wizard,
  per-kind config editors.
- docs: single deployments/ layout, manager/launcher, static kind throughout.

Live migration verified byte-identical: regenerated Caddyfile and every unit
ExecStart line unchanged, so nothing restarted. Suites: core 124, cli 25,
castle-api 55; dashboard build + type-check clean.

app/src/components/detail/ConfigPanel.tsx

@@ -23,11 +23,14 @@ export function ConfigPanel({ deployment, configSection, onRefetch }: ConfigPane
   const [pendingApply, setPendingApply] = useState(false)
   const [applying, setApplying] = useState(false)
   const isDeployment = configSection !== "programs"
+  // Programs are their own catalog; every deployment kind (service/job/tool/
+  // static) lives in the single deployments/ collection.
+  const writeSection = isDeployment ? "deployments" : "programs"
 
   const handleSave = async (compName: string, config: Record<string, unknown>) => {
     setMessage(null)
     try {
-      await apiClient.put(`/config/${configSection}/${compName}`, { config })
+      await apiClient.put(`/config/${writeSection}/${compName}`, { config })
       setMessage({
         type: "ok",
         text: isDeployment
@@ -71,7 +74,7 @@ export function ConfigPanel({ deployment, configSection, onRefetch }: ConfigPane
 
   const handleDelete = async (compName: string) => {
     try {
-      await apiClient.delete(`/config/${configSection}/${compName}`)
+      await apiClient.delete(`/config/${writeSection}/${compName}`)
       qc.invalidateQueries({ queryKey: [configSection] })
       navigate("/")
     } catch (e: unknown) {