Manager-first deployment model: split runner, merge service/job, frontend→static

Replace the conflated `runner` axis with two orthogonal ones: `manager`
(systemd|caddy|path|none) — who supervises/realizes a deployment — and, for
systemd only, a nested `launcher` (python|command|container|compose|node) — how
the process starts. ServiceSpec and JobSpec collapse into one manager-
discriminated DeploymentSpec union (Systemd/Caddy/Path/Remote); the services/
and jobs/ config dirs collapse into one deployments/ dir. The human "kind"
(service|job|tool|static|reference) is fully derived (kind_for), never stored —
the frontend kind is renamed static. behavior is gone.

- core: DeploymentSpec union + LaunchSpec + kind_for; legacy-aware loader
  normalizes old runner shapes; CastleConfig.deployments with derived
  services/jobs/tools views; registry.Deployment carries manager/launcher/kind.
- cli: service/job/tool as filtered views + a deployment group; --behavior→--kind,
  create --runner→--launcher; lifecycle dispatches over config.deployments.
- castle-api: /deployments primary with /services,/jobs as views; summaries
  derive kind; PUT/DELETE /config/deployments/{name} (services/jobs aliased).
- app: KindBadge, frontend→static everywhere, pick-a-kind creation wizard,
  per-kind config editors.
- docs: single deployments/ layout, manager/launcher, static kind throughout.

Live migration verified byte-identical: regenerated Caddyfile and every unit
ExecStart line unchanged, so nothing restarted. Suites: core 124, cli 25,
castle-api 55; dashboard build + type-check clean.

cli/src/castle_cli/manifest.py

@@ -3,26 +3,30 @@
 from castle_core.manifest import *  # noqa: F401, F403
 from castle_core.manifest import (  # noqa: F401 — explicit re-exports for type checkers
     BuildSpec,
+    CaddyDeployment,
     Capability,
     CommandsSpec,
     DefaultsSpec,
+    DeploymentBase,
+    DeploymentSpec,
     EnvMap,
     ExposeSpec,
     HttpExposeSpec,
     HttpInternal,
-    JobSpec,
+    LaunchBase,
+    LaunchSpec,
     ManageSpec,
+    PathDeployment,
     ProgramSpec,
     ReadinessHttpGet,
+    RemoteDeployment,
     RestartPolicy,
-    RunBase,
     RunCommand,
     RunCompose,
     RunContainer,
     RunNode,
     RunPython,
-    RunRemote,
-    RunSpec,
-    ServiceSpec,
+    SystemdDeployment,
     SystemdSpec,
+    kind_for,
 )