docs: fix stale TLS/routing references (audit sweep)

Cross-checked every doc against the code and fixed the stragglers the
apply/gateway/subdomain refactors left behind:

- Retired `tls: internal` mode: dropped the misleading reference in
  registry.md and the stale comment in config.py GatewayConfig (only
  off|acme exist; the dns-and-tls.md "was removed" note is kept as
  accurate history).
- Subdomain-only routing: fixed "path-based routing" claims in design.md
  (proxy list + mesh), "path prefix or host" → host, and the "path-prefix
  routes stay on :port" line in registry.md.
- Frontends serve at their subdomain root (VITE_BASE=/), not /<name>/:
  fixed supabase.md (x2), the scaffold.py docstring, the stacks.py build
  comment, and design.md's "serve prefix baked in" line.

README, AGENTS, developing-castle, dns-and-tls audited clean. Verified
against code; core 129 / cli 31 pass; ruff clean.

cli/src/castle_cli/templates/scaffold.py

@@ -573,7 +573,7 @@ def _scaffold_supabase(project_dir: Path, name: str, description: str) -> None:
 
     Produces migrations/ (applied to the substrate by `castle program build`),
     functions/ (deno edge functions), public/ (static UI served in place at
-    /<name>/ by the gateway), and supabase.app.yaml (auth policy + wiring).
+    <name>.<gateway.domain> by the gateway), and supabase.app.yaml (auth policy + wiring).
 
     The app owns its code and stays repo-durable; only its rows/blobs live on the
     shared substrate. Each app is isolated in its **own Postgres schema** (the app