Add gateway.tls=internal: HTTPS for host routes via Caddy's local CA

The gateway was HTTP-only by design, but a plain-HTTP origin is not a browser
"secure context", so apps that need WebCrypto (device identity, E2E crypto)
can't run when proxied — only localhost or HTTPS qualifies.

Add an opt-in `gateway.tls: internal`. When set, each host route
(proxy.caddy.host) is emitted as its own `<host> { tls internal; reverse_proxy }`
site, served over HTTPS by Caddy's local CA (Caddy binds :443 and redirects :80).
Path-prefix/static routes stay on the HTTP :<port> site — give a service a host
route to put it on HTTPS. Default (unset/off) keeps the existing HTTP-only
Caddyfile (single :<port> block, auto_https off, host matchers inline).

Plumbing mirrors gateway_port: GatewayConfig.tls (castle.yaml load/save) →
NodeConfig.gateway_tls (registry load/save, set in deploy) → the Caddyfile
generator. Tests cover both modes; docs/registry.md documents the option plus
the two operational requirements (binding 443/80 via the unprivileged-port
sysctl, and trusting Caddy's root CA on clients) and the host-route-vs-prefix
guidance that motivates it.

core/src/castle_core/registry.py

@@ -21,6 +21,7 @@ class NodeConfig:
     hostname: str = ""
     castle_root: str | None = None  # repo path, for dev commands
     gateway_port: int = 9000
+    gateway_tls: str | None = None  # None/"off" → HTTP-only; "internal" → Caddy local-CA HTTPS
 
     def __post_init__(self) -> None:
         if not self.hostname:
@@ -80,6 +81,7 @@ def load_registry(path: Path | None = None) -> NodeRegistry:
         hostname=node_data.get("hostname", ""),
         castle_root=node_data.get("castle_root"),
         gateway_port=node_data.get("gateway_port", 9000),
+        gateway_tls=node_data.get("gateway_tls"),
     )
 
     deployed: dict[str, Deployment] = {}
@@ -135,6 +137,9 @@ def save_registry(registry: NodeRegistry, path: Path | None = None) -> None:
     if registry.node.castle_root:
         data["node"]["castle_root"] = registry.node.castle_root
 
+    if registry.node.gateway_tls:
+        data["node"]["gateway_tls"] = registry.node.gateway_tls
+
     for name, comp in registry.deployed.items():
         entry: dict = {
             "runner": comp.runner,