docs: fix stale TLS/routing references (audit sweep)

Cross-checked every doc against the code and fixed the stragglers the
apply/gateway/subdomain refactors left behind:

- Retired `tls: internal` mode: dropped the misleading reference in
  registry.md and the stale comment in config.py GatewayConfig (only
  off|acme exist; the dns-and-tls.md "was removed" note is kept as
  accurate history).
- Subdomain-only routing: fixed "path-based routing" claims in design.md
  (proxy list + mesh), "path prefix or host" → host, and the "path-prefix
  routes stay on :port" line in registry.md.
- Frontends serve at their subdomain root (VITE_BASE=/), not /<name>/:
  fixed supabase.md (x2), the scaffold.py docstring, the stacks.py build
  comment, and design.md's "serve prefix baked in" line.

README, AGENTS, developing-castle, dns-and-tls audited clean. Verified
against code; core 129 / cli 31 pass; ruff clean.

core/src/castle_core/config.py

@@ -114,10 +114,8 @@ class GatewayConfig:
     """Gateway configuration."""
 
     port: int = 9000
-    # None/"off" → HTTP-only gateway. "internal" → Caddy serves host routes over
-    # HTTPS with its local CA (browsers get a secure context; trust the root CA).
-    # "acme" → real Let's Encrypt wildcard cert (*.domain) via a DNS-01 challenge;
-    # publicly trusted, no CA to install.
+    # None/"off" → HTTP-only gateway. "acme" → real Let's Encrypt wildcard cert
+    # (*.domain) via a DNS-01 challenge; publicly trusted, no CA to install.
     tls: str | None = None
     # acme mode only: the zone for the wildcard cert and host-route subdomains
     # (e.g. "civil.payne.io" → host routes become <service>.civil.payne.io).

core/src/castle_core/stacks.py

@@ -262,8 +262,8 @@ class ReactViteHandler(StackHandler):
 
     async def build(self, name: str, comp: ProgramSpec, root: Path) -> ActionResult:
         src = _source_dir(comp, root)
-        # Build against the gateway serve prefix so absolute asset URLs resolve at
-        # /<name>/ (vite.config reads VITE_BASE). Removes the hand-tuned-base footgun.
+        # Build against the gateway serve root so absolute asset URLs resolve at /
+        # (vite.config reads VITE_BASE=/). Removes the hand-tuned-base footgun.
         rc, output = await _run(
             _pnpm("build"), src, env={**_PNPM_ENV, "VITE_BASE": _vite_base(name)}
         )