Rename Installation to Instance

Follows the portal: the noun is "instance" everywhere the app says it —
UI strings, CLI output, error details, docs and comments. The wire keys
(`instance_id`, `instance_token`) and the hub route this calls move with it.

An existing cloud.json is adopted rather than refused: without the key
alias the dataclass fails to parse, which the caller swallows and reads as
"never enrolled" instead of "reconnect".

`instance_key` on a node type becomes `target_key`. It means the outside
thing a node points at, which is a different sense of the word, and keeping
both would put two meanings of "instance" in one codebase.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015YrQnKV3bnQd4K342y8tKj

frontend/src/client/sdk.gen.ts

@@ -177,7 +177,7 @@ export class ArtifactsService {
 export class CloudService {
     /**
      * Read Status
-     * Whether this installation is enrolled, and whether the link is up.
+     * Whether this instance is enrolled, and whether the link is up.
      *
      * Readable by any signed-in user: everyone here has a right to know whether
      * the machine they are using can be reached from outside.
@@ -196,7 +196,7 @@ export class CloudService {
      * Redeem a claim code and start dialling the portal.
      *
      * The account performing this is mapped to the portal account that owns the
-     * installation, so the owner's portal sessions arrive here as them. Widening
+     * instance, so the owner's portal sessions arrive here as them. Widening
      * that to anyone else is a local decision made one person at a time, below —
      * never something the portal can do from its side.
      *
@@ -1710,7 +1710,7 @@ export class PanelsService {
      * All this hands out is a code that means nothing until somebody with an
      * account approves it, so the worst an unwelcome caller achieves is an entry
      * that expires ten minutes later. Reachable from the internet when this
-     * installation is enrolled with a portal, which is what the cap and the
+     * instance is enrolled with a portal, which is what the cap and the
      * portal's own per-address limits are between.
      * @returns PairStarted Successful Response
      * @throws ApiError
@@ -1781,8 +1781,8 @@ export class PanelsService {
      *
      * A credential minted here names the approver, so what the panel does stays
      * attributable to a person rather than to nobody. One minted by the portal —
-     * for a device that reached this installation only through it — names the
-     * account this installation was enrolled with instead, since that is the one
+     * for a device that reached this instance only through it — names the
+     * account this instance was enrolled with instead, since that is the one
      * every portal-borne request already acts as.
      * @param data The data for the request.
      * @param data.panelId
@@ -2228,7 +2228,7 @@ export class SearchService {
      * Everything searchable, for the client to match against as it is typed.
      *
      * The whole index rather than a query: it is a few hundred short rows for an
-     * installation of any ordinary size, so one fetch when the panel opens beats a
+     * instance of any ordinary size, so one fetch when the panel opens beats a
      * round trip per keystroke — and the client already has a matcher.
      *
      * Secrets are named only to a superuser, which is who ``/secrets`` answers to.