Remove buttons: confirm + block program removal with active deployments

The Stage 2 editor split dropped the old confirm() — Remove program/service/job
deleted immediately on click. Restored confirmation on all three (FormFooter
window.confirm with a per-type message).

Removing a program that still has services/jobs referencing it would orphan
their program: ref. Now blocked:
- API: DELETE /config/programs/{name} → 409 'Programs with active jobs or
  services cannot be removed. Delete these first: …' (authoritative).
- App: ProgramFields shows the blocked reason instead of a Remove button when
  the program has deployments.
- CLI: castle delete refuses a program with referencing deployments not named
  the same (which would survive the delete dangling).

Verified live: DELETE program lakehouse → 409. api 52 / cli 24 green; build clean.

castle-api/src/castle_api/config_editor.py

@@ -169,13 +169,27 @@ def save_program(name: str, request: ProgramConfigRequest) -> dict:
 
 @router.delete("/programs/{name}")
 def delete_program(name: str) -> dict:
-    """Remove a program from castle.yaml."""
+    """Remove a program from castle.yaml.
+
+    Refuses if any service or job still references the program — those
+    deployments must be removed first so no dangling `program:` ref is left.
+    """
     config = get_config()
     if name not in config.programs:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
             detail=f"Program '{name}' not found",
         )
+    refs = [s for s, spec in config.services.items() if spec.program == name]
+    refs += [j for j, spec in config.jobs.items() if spec.program == name]
+    if refs:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail=(
+                "Programs with active jobs or services cannot be removed. "
+                f"Delete these first: {', '.join(refs)}"
+            ),
+        )
     del config.programs[name]
     save_config(config)
     return {"ok": True, "program": name, "action": "deleted"}