Dashboard: kind filters on Programs, tools off Services page, in-app confirm modals

- /services was returning every non-job deployment (tools, statics, remotes);
  filter it to kind==service so the Services page shows only services.
- Programs page gains kind-filter chips (All / Service / Job / Tool / Static /
  Reference) with per-kind counts, colored to match KindBadge.
- Replace window.confirm with a reusable ConfirmModal (styled, danger variant,
  Esc/Enter, preserves bulleted bodies); FormFooter's delete uses it, so program/
  service/job deletion now confirms in-app with the enumerated cascade list.

castle-api 58 passed; /services live drops from 37 to 15 (services only).

castle-api/tests/test_health.py

@@ -113,6 +113,13 @@ class TestServicesList:
         names = [s["id"] for s in data]
         assert "test-job" not in names
 
+    def test_excludes_tools(self, client: TestClient) -> None:
+        """Tools (path deployments) are not in the services list."""
+        response = client.get("/services")
+        data = response.json()
+        names = [s["id"] for s in data]
+        assert "test-tool" not in names
+
 
 class TestServiceDetail:
     """GET /services/{name} endpoint tests."""
@@ -246,8 +253,9 @@ class TestGateway:
         data = response.json()
         assert data["port"] == 9000
         assert data["hostname"] == "test-node"
-        # Registry has 1 deployed component (test-svc)
-        assert data["deployment_count"] == 1
+        # Registry has 2 deployed components (test-svc + test-tool); only the
+        # service is a managed systemd deployment.
+        assert data["deployment_count"] == 2
         assert data["service_count"] == 1
         assert data["managed_count"] == 1