feat(core): kind-scoped deployment identity (name, kind)

A deployment's identity becomes (name, kind), so a tool, service, and job can
share a name (a `backup` trio). Kind is structural — which per-kind store / dir —
not a derived discriminator threaded around.

- CastleConfig holds per-kind stores (services/jobs/tools/statics/references);
  all_deployments()/deployments_named()/deployment(kind,name) replace the single
  flat `deployments` dict. A construction-only `deployments` InitVar routes a flat
  map into the stores by kind_for.
- Storage: deployments/<store>/<name>.yaml (per-kind dirs), with read-compat for
  the old flat + services/+jobs/ layouts.
- Registry keyed by composite "<kind>/<name>" + name field; get()/all()/named()/put().
- Job units carry a -job marker (castle-<name>-job.{service,timer}); services and
  everything else unchanged — so a service and a job can coexist.
- deploy/apply/lifecycle thread kind through unit naming, activate/deactivate,
  is_active; caddyfile/tunnel/relations iterate via all_deployments/registry.all.
- Subdomain uniqueness validated across kinds (a service and a static can't share one).

182 core tests pass, incl. a new same-name-trio suite (round-trip, distinct units,
subdomain guard). API/CLI/UI updated in follow-up phases.

core/tests/test_apply.py

@@ -17,7 +17,10 @@ from castle_core.registry import Deployment
 
 def _plan(castle_root: Path, active: dict[str, bool]):
     """Run apply(plan=True) with is_active stubbed to `active` (default False)."""
-    with patch("castle_core.lifecycle.is_active", side_effect=lambda n, c: active.get(n, False)):
+    with patch(
+        "castle_core.lifecycle.is_active",
+        side_effect=lambda n, k, c: active.get(n, False),
+    ):
         return apply(root=castle_root, plan=True)
 
 
@@ -71,4 +74,4 @@ def test_render_unit_preview_none_for_non_systemd() -> None:
     A path deployment is unmanaged, so the renderer returns before touching config.
     """
     tool = Deployment(manager="path", run_cmd=[], kind="tool")
-    assert _render_unit_preview(None, "x", tool, is_job=False) is None  # type: ignore[arg-type]
+    assert _render_unit_preview(None, "x", tool, "tool") is None  # type: ignore[arg-type]