docs: fix stale TLS/routing references (audit sweep)

Cross-checked every doc against the code and fixed the stragglers the
apply/gateway/subdomain refactors left behind:

- Retired `tls: internal` mode: dropped the misleading reference in
  registry.md and the stale comment in config.py GatewayConfig (only
  off|acme exist; the dns-and-tls.md "was removed" note is kept as
  accurate history).
- Subdomain-only routing: fixed "path-based routing" claims in design.md
  (proxy list + mesh), "path prefix or host" → host, and the "path-prefix
  routes stay on :port" line in registry.md.
- Frontends serve at their subdomain root (VITE_BASE=/), not /<name>/:
  fixed supabase.md (x2), the scaffold.py docstring, the stacks.py build
  comment, and design.md's "serve prefix baked in" line.

README, AGENTS, developing-castle, dns-and-tls audited clean. Verified
against code; core 129 / cli 31 pass; ruff clean.

core/src/castle_core/config.py

@@ -114,10 +114,8 @@ class GatewayConfig:
     """Gateway configuration."""
 
     port: int = 9000
-    # None/"off" → HTTP-only gateway. "internal" → Caddy serves host routes over
-    # HTTPS with its local CA (browsers get a secure context; trust the root CA).
-    # "acme" → real Let's Encrypt wildcard cert (*.domain) via a DNS-01 challenge;
-    # publicly trusted, no CA to install.
+    # None/"off" → HTTP-only gateway. "acme" → real Let's Encrypt wildcard cert
+    # (*.domain) via a DNS-01 challenge; publicly trusted, no CA to install.
     tls: str | None = None
     # acme mode only: the zone for the wildcard cert and host-route subdomains
     # (e.g. "civil.payne.io" → host routes become <service>.civil.payne.io).