Rename Installation to Instance

Follows the portal: the noun is "instance" everywhere the app says it —
UI strings, CLI output, error details, docs and comments. The wire keys
(`instance_id`, `instance_token`) and the hub route this calls move with it.

An existing cloud.json is adopted rather than refused: without the key
alias the dataclass fails to parse, which the caller swallows and reads as
"never enrolled" instead of "reconnect".

`instance_key` on a node type becomes `target_key`. It means the outside
thing a node points at, which is a different sense of the word, and keeping
both would put two meanings of "instance" in one codebase.

frontend/src/lib/webpush.ts

@@ -1,13 +1,13 @@
 /**
- * Subscribing this browser to the installation's notifications.
+ * Subscribing this browser to the instance's notifications.
  *
  * A push arrives through the service worker, so it reaches a phone with no tab
  * open — which is the whole point, and the reason this is not the in-app
  * notification stack. The engine decides *what* is worth sending in its alert
  * rules; this only says which browsers hear it.
  *
- * Everything here is per browser and per installation: the subscription is
- * stored by the installation it was made against, so a phone that opens two
+ * Everything here is per browser and per instance: the subscription is
+ * stored by the instance it was made against, so a phone that opens two
  * houses through the portal is two subscriptions and hears each separately.
  */
 
@@ -62,7 +62,7 @@ function keyBytes(key: string): Uint8Array<ArrayBuffer> {
 }
 
 /**
- * Ask permission, subscribe, and tell the installation where to reach us.
+ * Ask permission, subscribe, and tell the instance where to reach us.
  *
  * Throws with something worth reading if the person says no — the caller puts
  * it on screen, because a silently ignored button is worse than a refusal.