Manager-first deployment model: split runner, merge service/job, frontend→static

Replace the conflated `runner` axis with two orthogonal ones: `manager`
(systemd|caddy|path|none) — who supervises/realizes a deployment — and, for
systemd only, a nested `launcher` (python|command|container|compose|node) — how
the process starts. ServiceSpec and JobSpec collapse into one manager-
discriminated DeploymentSpec union (Systemd/Caddy/Path/Remote); the services/
and jobs/ config dirs collapse into one deployments/ dir. The human "kind"
(service|job|tool|static|reference) is fully derived (kind_for), never stored —
the frontend kind is renamed static. behavior is gone.

- core: DeploymentSpec union + LaunchSpec + kind_for; legacy-aware loader
  normalizes old runner shapes; CastleConfig.deployments with derived
  services/jobs/tools views; registry.Deployment carries manager/launcher/kind.
- cli: service/job/tool as filtered views + a deployment group; --behavior→--kind,
  create --runner→--launcher; lifecycle dispatches over config.deployments.
- castle-api: /deployments primary with /services,/jobs as views; summaries
  derive kind; PUT/DELETE /config/deployments/{name} (services/jobs aliased).
- app: KindBadge, frontend→static everywhere, pick-a-kind creation wizard,
  per-kind config editors.
- docs: single deployments/ layout, manager/launcher, static kind throughout.

Live migration verified byte-identical: regenerated Caddyfile and every unit
ExecStart line unchanged, so nothing restarted. Suites: core 124, cli 25,
castle-api 55; dashboard build + type-check clean.

core/tests/test_tunnel.py

@@ -28,9 +28,9 @@ def _registry(
         ),
         deployed=deployed
         or {
-            "app": Deployment(runner="python", run_cmd=["x"], port=9001,
+            "app": Deployment(manager="systemd", launcher="python", run_cmd=["x"], port=9001,
                               subdomain="app", public=True),
-            "private": Deployment(runner="python", run_cmd=["y"], port=9002,
+            "private": Deployment(manager="systemd", launcher="python", run_cmd=["y"], port=9002,
                                  subdomain="private", public=False),
         },
     )
@@ -60,7 +60,7 @@ def test_private_service_not_in_public_dns() -> None:
 
 def test_none_when_no_public_services() -> None:
     only_private = {
-        "x": Deployment(runner="python", run_cmd=["x"], subdomain="x", public=False)
+        "x": Deployment(manager="systemd", launcher="python", run_cmd=["x"], subdomain="x", public=False)
     }
     assert generate_tunnel_config(_registry(deployed=only_private)) is None
 
@@ -74,7 +74,7 @@ def test_public_static_frontend_gets_ingress() -> None:
     # A `static` (frontend) service can be public too — the toggle composes for
     # any exposed deployment, process-backed or not.
     reg = _registry(deployed={
-        "guestbook": Deployment(runner="static", run_cmd=[], subdomain="guestbook",
+        "guestbook": Deployment(manager="caddy", run_cmd=[], subdomain="guestbook",
                                static_root="/data/repos/guestbook/public", public=True),
     })
     hosts = {r["hostname"] for r in yaml.safe_load(generate_tunnel_config(reg))["ingress"]