Rename Installation to Instance

Follows the portal: the noun is "instance" everywhere the app says it —
UI strings, CLI output, error details, docs and comments. The wire keys
(`instance_id`, `instance_token`) and the hub route this calls move with it.

An existing cloud.json is adopted rather than refused: without the key
alias the dataclass fails to parse, which the caller swallows and reads as
"never enrolled" instead of "reconnect".

`instance_key` on a node type becomes `target_key`. It means the outside
thing a node points at, which is a different sense of the word, and keeping
both would put two meanings of "instance" in one codebase.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015YrQnKV3bnQd4K342y8tKj

backend/fluksio/api/deps.py

@@ -51,7 +51,7 @@ def _panel_for(payload: dict[str, Any]) -> panels.PanelDef:
     effect at once. Or the panel's nonce moved on, which revokes exactly one
     screen's and leaves the panel, its dashboards and their arrangement alone.
 
-    The nonce is only held against a credential this installation signed. One
+    The nonce is only held against a credential this instance signed. One
     the portal minted for a remote screen carries none — the portal names the
     panel and nothing else — and is revoked at the hub instead.
     """
@@ -182,11 +182,11 @@ def decode_token(token: str, request: Request | None = None) -> dict[str, Any]:
     guards.
 
     The last branch is the seam a hosted deployment widens: a portal this
-    installation was enrolled with signs tokens with a key pinned at
+    instance was enrolled with signs tokens with a key pinned at
     enrolment, and they name the portal account holding them, which resolves
     to whichever local account was mapped to it — the superuser who enrolled,
     or a remote user one of them admitted since. With no enrolment the branch
-    raises immediately, so an offline installation pays nothing for the
+    raises immediately, so an offline instance pays nothing for the
     possibility. A screen that paired through that portal
     arrives there too, naming a panel — which is why the gate below is applied
     to whichever branch produced the claims rather than to one of them: where a