api: POST /apply converge endpoint; enabled in summaries

- Replace POST /deploy with POST /apply (name + plan), returning the
  enacted diff (activated/restarted/deactivated/unchanged). /config/apply
  now delegates to core apply() too, so there's one convergence path.
- Retire /services/{name}/start and /stop (keep /restart as the
  imperative bounce). Drop install/uninstall from program actions — tool/
  static activation is convergence now.
- Surface `enabled` on ServiceSummary/JobSummary/DeploymentSummary so the
  UI can show and toggle desired state.
- conftest: drop the obsolete config_editor.get_registry patch (apply_config
  no longer reads the registry directly).

59 API tests pass; route table shows /apply (no /deploy), /restart only.

castle-api/tests/conftest.py

@@ -164,7 +164,6 @@ def registry_path(tmp_path: Path, castle_root: Path) -> Generator[Path, None, No
         "services.get_castle_root": services_mod.get_castle_root,
         "nodes.get_registry": nodes_mod.get_registry,
         "stream.get_registry": stream_mod.get_registry,
-        "config_editor.get_registry": config_editor_mod.get_registry,
         "config_editor.get_castle_root": config_editor_mod.get_castle_root,
     }
 
@@ -192,7 +191,6 @@ def registry_path(tmp_path: Path, castle_root: Path) -> Generator[Path, None, No
     services_mod.get_castle_root = originals["services.get_castle_root"]
     nodes_mod.get_registry = originals["nodes.get_registry"]
     stream_mod.get_registry = originals["stream.get_registry"]
-    config_editor_mod.get_registry = originals["config_editor.get_registry"]
     config_editor_mod.get_castle_root = originals["config_editor.get_castle_root"]