Dashboard: kind filters on Programs, tools off Services page, in-app confirm modals

- /services was returning every non-job deployment (tools, statics, remotes);
  filter it to kind==service so the Services page shows only services.
- Programs page gains kind-filter chips (All / Service / Job / Tool / Static /
  Reference) with per-kind counts, colored to match KindBadge.
- Replace window.confirm with a reusable ConfirmModal (styled, danger variant,
  Esc/Enter, preserves bulleted bodies); FormFooter's delete uses it, so program/
  service/job deletion now confirms in-app with the enumerated cascade list.

castle-api 58 passed; /services live drops from 37 to 15 (services only).

castle-api/tests/test_nodes.py

@@ -28,8 +28,8 @@ class TestNodesList:
         response = client.get("/nodes")
         data = response.json()
         local = data[0]
-        assert local["deployed_count"] == 1  # test-svc
-        assert local["service_count"] == 1
+        assert local["deployed_count"] == 2  # test-svc + test-tool
+        assert local["service_count"] == 1  # only test-svc is a service
 
     def test_includes_remote_nodes(self, client: TestClient, registry_path: Path) -> None:
         """Remote nodes from mesh state are included."""
@@ -81,9 +81,9 @@ class TestNodeDetail:
         data = response.json()
         assert data["hostname"] == "test-node"
         assert data["is_local"] is True
-        assert len(data["deployed"]) == 1
-        assert data["deployed"][0]["id"] == "test-svc"
-        assert data["deployed"][0]["node"] == "test-node"
+        assert len(data["deployed"]) == 2  # test-svc + test-tool
+        svc = next(d for d in data["deployed"] if d["id"] == "test-svc")
+        assert svc["node"] == "test-node"
 
     def test_unknown_node_returns_404(self, client: TestClient) -> None:
         """Returns 404 for unknown hostname."""