Manager-first deployment model: split runner, merge service/job, frontend→static

Replace the conflated `runner` axis with two orthogonal ones: `manager`
(systemd|caddy|path|none) — who supervises/realizes a deployment — and, for
systemd only, a nested `launcher` (python|command|container|compose|node) — how
the process starts. ServiceSpec and JobSpec collapse into one manager-
discriminated DeploymentSpec union (Systemd/Caddy/Path/Remote); the services/
and jobs/ config dirs collapse into one deployments/ dir. The human "kind"
(service|job|tool|static|reference) is fully derived (kind_for), never stored —
the frontend kind is renamed static. behavior is gone.

- core: DeploymentSpec union + LaunchSpec + kind_for; legacy-aware loader
  normalizes old runner shapes; CastleConfig.deployments with derived
  services/jobs/tools views; registry.Deployment carries manager/launcher/kind.
- cli: service/job/tool as filtered views + a deployment group; --behavior→--kind,
  create --runner→--launcher; lifecycle dispatches over config.deployments.
- castle-api: /deployments primary with /services,/jobs as views; summaries
  derive kind; PUT/DELETE /config/deployments/{name} (services/jobs aliased).
- app: KindBadge, frontend→static everywhere, pick-a-kind creation wizard,
  per-kind config editors.
- docs: single deployments/ layout, manager/launcher, static kind throughout.

Live migration verified byte-identical: regenerated Caddyfile and every unit
ExecStart line unchanged, so nothing restarted. Suites: core 124, cli 25,
castle-api 55; dashboard build + type-check clean.

castle-api/tests/test_programs_commands.py

@@ -24,9 +24,9 @@ class TestProgramCommands:
         assert set(w["actions"]) >= {"lint", "test", "run"}
         assert "build" not in w["actions"]  # not declared, no stack
 
-    def test_tools_via_behavior_filter(self, client: TestClient) -> None:
-        """Tools are reached via /programs?behavior=tool (no dedicated /tools)."""
-        resp = client.get("/programs", params={"behavior": "tool"})
+    def test_tools_via_kind_filter(self, client: TestClient) -> None:
+        """Tools are reached via /programs?kind=tool (no dedicated /tools)."""
+        resp = client.get("/programs", params={"kind": "tool"})
         assert resp.status_code == 200
         ids = [p["id"] for p in resp.json()]
         assert "wired-in" in ids and "test-tool" in ids