fix(api): editable-spec detail + PATCH-merge saves + shared gateway parser

Deployment/program edits could silently drop spec fields:

- GET /deployments/{name} served the runtime view (no reach/program/root/expose)
  for deployed deployments, so the dashboard round-tripped a lossy manifest and
  stripped fields on save (broke astro). Now serves the editable castle.yaml spec
  when the deployment is in config.
- _save_deployment and save_program replaced the whole object with client input.
  Now shallow-merge over the existing spec (omit = preserve, null = clear), so a
  partial/lossy save can't drop untouched fields.
- save_yaml rebuilt GatewayConfig from `port` only, wiping tls/domain/tunnel/
  cert_hook on a whole-file save. Now uses a shared parse_gateway() (also used by
  load_config) so gateway fields can't drift between the two.

Dashboard forms (ServiceFields/StaticFields) send explicit null to clear, per the
merge contract; adds exposure host-label helpers. Coverage: detail-serves-spec,
save round-trip, partial-patch-preserves, null-clears, program partial-patch,
parse_gateway, and config save/load round-trip.

core/src/castle_core/config.py

@@ -347,6 +347,26 @@ def _load_resource_dir(directory: Path) -> dict[str, dict]:
     return result
 
 
+def parse_gateway(gateway_data: dict) -> GatewayConfig:
+    """Build a GatewayConfig from a castle.yaml ``gateway:`` mapping.
+
+    The single parser shared by ``load_config`` and the API's whole-file editor,
+    so a newly added gateway field can't be honored in one place and silently
+    dropped in the other (which is exactly how ``cert_hook`` got wiped on a
+    full-config save).
+    """
+    return GatewayConfig(
+        port=gateway_data.get("port", 9000),
+        tls=gateway_data.get("tls"),
+        domain=gateway_data.get("domain"),
+        acme_email=gateway_data.get("acme_email"),
+        acme_dns_provider=gateway_data.get("acme_dns_provider", "cloudflare"),
+        public_domain=gateway_data.get("public_domain"),
+        tunnel_id=gateway_data.get("tunnel_id"),
+        cert_hook=gateway_data.get("cert_hook", False),
+    )
+
+
 def load_config(root: Path | None = None) -> CastleConfig:
     """Load castle config: global castle.yaml + programs/ and deployments/ dirs."""
     if root is None:
@@ -359,17 +379,7 @@ def load_config(root: Path | None = None) -> CastleConfig:
     with open(config_path) as f:
         data = yaml.safe_load(f) or {}
 
-    gateway_data = data.get("gateway", {})
-    gateway = GatewayConfig(
-        port=gateway_data.get("port", 9000),
-        tls=gateway_data.get("tls"),
-        domain=gateway_data.get("domain"),
-        acme_email=gateway_data.get("acme_email"),
-        acme_dns_provider=gateway_data.get("acme_dns_provider", "cloudflare"),
-        public_domain=gateway_data.get("public_domain"),
-        tunnel_id=gateway_data.get("tunnel_id"),
-        cert_hook=gateway_data.get("cert_hook", False),
-    )
+    gateway = parse_gateway(data.get("gateway", {}))
 
     # repo: field points to the git repo for repo-relative sources
     repo_path: Path | None = None

core/tests/test_config.py

@@ -248,3 +248,84 @@ class TestResolveEnvSplit:
         flat = resolve_env_vars(env, {"port": "9001"})
         assert flat == {"PORT": "9001", "K": "v", "Z": "lit"}
         assert list(flat.keys()) == ["PORT", "K", "Z"]
+
+
+class TestConfigRoundTrip:
+    """save_config → load_config must preserve every field. A field missing from
+    the save path (the `cert_hook` regression) or the serializer silently drops on
+    the next write — these lock the full round-trip for the reach/TCP-TLS fields."""
+
+    def test_gateway_and_tcp_tls_survive_save_load(self, tmp_path: Path) -> None:
+        from castle_core.config import GatewayConfig
+        from castle_core.manifest import (
+            ExposeSpec,
+            Reach,
+            RunContainer,
+            SystemdDeployment,
+            TcpExposeSpec,
+            TlsMaterial,
+            TlsSpec,
+        )
+
+        pg = SystemdDeployment(
+            id="pg",
+            manager="systemd",
+            program="pg",
+            reach=Reach.INTERNAL,
+            run=RunContainer(
+                launcher="container",
+                image="postgres:17",
+                user="${uid}:${gid}",
+                tmpfs=["/var/run/postgresql"],
+            ),
+            expose=ExposeSpec(
+                tcp=TcpExposeSpec(port=5432, tls=TlsSpec(material=TlsMaterial.PAIR))
+            ),
+        )
+        config = CastleConfig(
+            root=tmp_path,
+            gateway=GatewayConfig(
+                port=9000, tls="acme", domain="civil.payne.io", cert_hook=True
+            ),
+            repo=None,
+            programs={},
+            deployments={"pg": pg},
+        )
+        save_config(config)
+        loaded = load_config(tmp_path)
+
+        # Gateway: cert_hook must survive (the field that got dropped in prod).
+        assert loaded.gateway.cert_hook is True
+        assert loaded.gateway.tls == "acme"
+        assert loaded.gateway.domain == "civil.payne.io"
+
+        # Deployment: reach + full TCP/TLS + container user/tmpfs must survive.
+        d = loaded.deployments["pg"]
+        assert d.reach == Reach.INTERNAL
+        assert d.expose.tcp.port == 5432
+        assert d.expose.tcp.tls.material == TlsMaterial.PAIR
+        assert d.run.user == "${uid}:${gid}"
+        assert d.run.tmpfs == ["/var/run/postgresql"]
+
+    def test_parse_gateway_preserves_all_fields(self) -> None:
+        """The shared gateway parser must honor every field — `save_yaml` used to
+        read only `port`, wiping tls/domain/tunnel/cert_hook on a whole-file save."""
+        from castle_core.config import parse_gateway
+
+        g = parse_gateway(
+            {
+                "port": 9000,
+                "tls": "acme",
+                "domain": "civil.payne.io",
+                "acme_email": "a@b.co",
+                "public_domain": "pub.io",
+                "tunnel_id": "uuid-123",
+                "cert_hook": True,
+            }
+        )
+        assert g.tls == "acme"
+        assert g.domain == "civil.payne.io"
+        assert g.acme_email == "a@b.co"
+        assert g.public_domain == "pub.io"
+        assert g.tunnel_id == "uuid-123"
+        assert g.cert_hook is True