feat(core): kind-scoped deployment identity (name, kind)

A deployment's identity becomes (name, kind), so a tool, service, and job can
share a name (a `backup` trio). Kind is structural — which per-kind store / dir —
not a derived discriminator threaded around.

- CastleConfig holds per-kind stores (services/jobs/tools/statics/references);
  all_deployments()/deployments_named()/deployment(kind,name) replace the single
  flat `deployments` dict. A construction-only `deployments` InitVar routes a flat
  map into the stores by kind_for.
- Storage: deployments/<store>/<name>.yaml (per-kind dirs), with read-compat for
  the old flat + services/+jobs/ layouts.
- Registry keyed by composite "<kind>/<name>" + name field; get()/all()/named()/put().
- Job units carry a -job marker (castle-<name>-job.{service,timer}); services and
  everything else unchanged — so a service and a job can coexist.
- deploy/apply/lifecycle thread kind through unit naming, activate/deactivate,
  is_active; caddyfile/tunnel/relations iterate via all_deployments/registry.all.
- Subdomain uniqueness validated across kinds (a service and a static can't share one).

182 core tests pass, incl. a new same-name-trio suite (round-trip, distinct units,
subdomain guard). API/CLI/UI updated in follow-up phases.

core/tests/test_deploy_secret_env.py

@@ -61,17 +61,16 @@ class TestWriteSecretEnvFile:
 class TestRegistrySecretKeys:
     def test_round_trip_persists_keys_only(self, tmp_path: Path) -> None:
         reg_path = tmp_path / "registry.yaml"
-        registry = NodeRegistry(
-            node=NodeConfig(hostname="h"),
-            deployed={
-                "svc": Deployment(
-                    manager="systemd", launcher="container",
-                    run_cmd=["docker", "run"],
-                    env={"PORT": "9001"},
-                    secret_env_keys=["ANTHROPIC_API_KEY", "OPENAI_API_KEY"],
-                    managed=True,
-                )
-            },
+        registry = NodeRegistry(node=NodeConfig(hostname="h"))
+        registry.put(
+            Deployment(
+                manager="systemd", launcher="container",
+                run_cmd=["docker", "run"],
+                env={"PORT": "9001"},
+                secret_env_keys=["ANTHROPIC_API_KEY", "OPENAI_API_KEY"],
+                managed=True,
+                name="svc",
+            )
         )
         save_registry(registry, reg_path)
 
@@ -80,8 +79,6 @@ class TestRegistrySecretKeys:
         assert "sk-ant" not in text  # but no values ever
 
         loaded = load_registry(reg_path)
-        assert loaded.deployed["svc"].secret_env_keys == [
-            "ANTHROPIC_API_KEY",
-            "OPENAI_API_KEY",
-        ]
-        assert loaded.deployed["svc"].env == {"PORT": "9001"}
+        svc = loaded.get("service", "svc")
+        assert svc.secret_env_keys == ["ANTHROPIC_API_KEY", "OPENAI_API_KEY"]
+        assert svc.env == {"PORT": "9001"}