docs: fix stale TLS/routing references (audit sweep)

Cross-checked every doc against the code and fixed the stragglers the
apply/gateway/subdomain refactors left behind:

- Retired `tls: internal` mode: dropped the misleading reference in
  registry.md and the stale comment in config.py GatewayConfig (only
  off|acme exist; the dns-and-tls.md "was removed" note is kept as
  accurate history).
- Subdomain-only routing: fixed "path-based routing" claims in design.md
  (proxy list + mesh), "path prefix or host" → host, and the "path-prefix
  routes stay on :port" line in registry.md.
- Frontends serve at their subdomain root (VITE_BASE=/), not /<name>/:
  fixed supabase.md (x2), the scaffold.py docstring, the stacks.py build
  comment, and design.md's "serve prefix baked in" line.

README, AGENTS, developing-castle, dns-and-tls audited clean. Verified
against code; core 129 / cli 31 pass; ruff clean.

core/src/castle_core/stacks.py

@@ -262,8 +262,8 @@ class ReactViteHandler(StackHandler):
 
     async def build(self, name: str, comp: ProgramSpec, root: Path) -> ActionResult:
         src = _source_dir(comp, root)
-        # Build against the gateway serve prefix so absolute asset URLs resolve at
-        # /<name>/ (vite.config reads VITE_BASE). Removes the hand-tuned-base footgun.
+        # Build against the gateway serve root so absolute asset URLs resolve at /
+        # (vite.config reads VITE_BASE=/). Removes the hand-tuned-base footgun.
         rc, output = await _run(
             _pnpm("build"), src, env={**_PNPM_ENV, "VITE_BASE": _vite_base(name)}
         )