Rename Installation to Instance

Follows the portal: the noun is "instance" everywhere the app says it —
UI strings, CLI output, error details, docs and comments. The wire keys
(`instance_id`, `instance_token`) and the hub route this calls move with it.

An existing cloud.json is adopted rather than refused: without the key
alias the dataclass fails to parse, which the caller swallows and reads as
"never enrolled" instead of "reconnect".

`instance_key` on a node type becomes `target_key`. It means the outside
thing a node points at, which is a different sense of the word, and keeping
both would put two meanings of "instance" in one codebase.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015YrQnKV3bnQd4K342y8tKj

docs/interface/operations.md

@@ -1,7 +1,7 @@
 # Secrets, modules and alerts
 
 Three screens that have nothing to do with each other except that an
-installation you actually depend on needs all of them.
+instance you actually depend on needs all of them.
 
 ## Secrets
 
@@ -18,7 +18,7 @@ have stored.
 **Secrets** is where the values live. Add a name and a value; the value is
 never shown again, and the list only ever shows names.
 
-They are encrypted at rest with a key derived from the installation's
+They are encrypted at rest with a key derived from the instance's
 `SECRET_KEY`, and kept **outside** the flow repository. That matters because
 flows are a git repository you may well push somewhere: what gets committed and
 shared never contains a password.
@@ -35,7 +35,7 @@ authentication failure.
 
 ## Modules
 
-Node code runs in a virtual environment of its own, on the installation's data
+Node code runs in a virtual environment of its own, on the instance's data
 volume — separate from the packages Fluksio itself runs on. A pin of yours can
 never shadow one of ours, and vice versa.
 
@@ -69,7 +69,7 @@ where you say who hears about it.
 | Kind | Settings |
 |---|---|
 | **ntfy** | server, topic, and a token for a protected topic |
-| **SMTP** | an address to send to (the installation's mail settings do the rest) |
+| **SMTP** | an address to send to (the instance's mail settings do the rest) |
 | **Webhook** | a URL to POST to |
 | **Dashboard** | a message name a notification widget reads |
 
@@ -126,6 +126,6 @@ are registered.
 Your own account: name, email, password, and appearance (light, dark, or
 follow the system).
 
-**Remote access** is where an installation is paired with a portal, remote
+**Remote access** is where an instance is paired with a portal, remote
 users are admitted, and the link is cut again. That has [its own
 page](portal.md).