Remove buttons: confirm + block program removal with active deployments

The Stage 2 editor split dropped the old confirm() — Remove program/service/job
deleted immediately on click. Restored confirmation on all three (FormFooter
window.confirm with a per-type message).

Removing a program that still has services/jobs referencing it would orphan
their program: ref. Now blocked:
- API: DELETE /config/programs/{name} → 409 'Programs with active jobs or
  services cannot be removed. Delete these first: …' (authoritative).
- App: ProgramFields shows the blocked reason instead of a Remove button when
  the program has deployments.
- CLI: castle delete refuses a program with referencing deployments not named
  the same (which would survive the delete dangling).

Verified live: DELETE program lakehouse → 409. api 52 / cli 24 green; build clean.

app/src/components/detail/ProgramFields.tsx

@@ -95,6 +95,12 @@ export function ProgramFields({ program, onSave, onDelete }: Props) {
         onSave={handleSave}
         onDelete={onDelete ? () => onDelete(program.id) : undefined}
         deleteLabel="Remove program"
+        confirmMessage={`Remove program "${program.id}" from castle.yaml? (Source on disk is untouched.)`}
+        deleteBlocked={
+          program.services.length + program.jobs.length > 0
+            ? "Programs with active jobs or services cannot be removed — delete those first."
+            : undefined
+        }
       />
     </div>
   )