Manager-first deployment model: split runner, merge service/job, frontend→static

Replace the conflated `runner` axis with two orthogonal ones: `manager`
(systemd|caddy|path|none) — who supervises/realizes a deployment — and, for
systemd only, a nested `launcher` (python|command|container|compose|node) — how
the process starts. ServiceSpec and JobSpec collapse into one manager-
discriminated DeploymentSpec union (Systemd/Caddy/Path/Remote); the services/
and jobs/ config dirs collapse into one deployments/ dir. The human "kind"
(service|job|tool|static|reference) is fully derived (kind_for), never stored —
the frontend kind is renamed static. behavior is gone.

- core: DeploymentSpec union + LaunchSpec + kind_for; legacy-aware loader
  normalizes old runner shapes; CastleConfig.deployments with derived
  services/jobs/tools views; registry.Deployment carries manager/launcher/kind.
- cli: service/job/tool as filtered views + a deployment group; --behavior→--kind,
  create --runner→--launcher; lifecycle dispatches over config.deployments.
- castle-api: /deployments primary with /services,/jobs as views; summaries
  derive kind; PUT/DELETE /config/deployments/{name} (services/jobs aliased).
- app: KindBadge, frontend→static everywhere, pick-a-kind creation wizard,
  per-kind config editors.
- docs: single deployments/ layout, manager/launcher, static kind throughout.

Live migration verified byte-identical: regenerated Caddyfile and every unit
ExecStart line unchanged, so nothing restarted. Suites: core 124, cli 25,
castle-api 55; dashboard build + type-check clean.

docs/tunnel-setup.md

@@ -54,12 +54,14 @@ chmod 600 ~/.castle/secrets/cloudflared/$TID.json
 #      tunnel_id: <the-uuid>
 ```
 
-Then create the tunnel service at `~/.castle/services/castle-tunnel.yaml`:
+Then create the tunnel deployment at `~/.castle/deployments/castle-tunnel.yaml`
+(`manager: systemd` → kind: service):
 
 ```yaml
 description: Cloudflare tunnel — public exposure for public:true services
+manager: systemd
 run:
-  runner: command
+  launcher: command
   argv:
     - cloudflared
     - tunnel
@@ -80,7 +82,7 @@ castle service enable castle-tunnel # start the tunnel
 
 ## Using the toggle
 
-Mark a service public in its `services/<name>.yaml`:
+Mark a service public in its `deployments/<name>.yaml`:
 
 ```yaml
 proxy: true      # required — the service must be routed