docs: fix stale TLS/routing references (audit sweep)

Cross-checked every doc against the code and fixed the stragglers the
apply/gateway/subdomain refactors left behind:

- Retired `tls: internal` mode: dropped the misleading reference in
  registry.md and the stale comment in config.py GatewayConfig (only
  off|acme exist; the dns-and-tls.md "was removed" note is kept as
  accurate history).
- Subdomain-only routing: fixed "path-based routing" claims in design.md
  (proxy list + mesh), "path prefix or host" → host, and the "path-prefix
  routes stay on :port" line in registry.md.
- Frontends serve at their subdomain root (VITE_BASE=/), not /<name>/:
  fixed supabase.md (x2), the scaffold.py docstring, the stacks.py build
  comment, and design.md's "serve prefix baked in" line.

README, AGENTS, developing-castle, dns-and-tls audited clean. Verified
against code; core 129 / cli 31 pass; ruff clean.

docs/stacks/supabase.md

@@ -63,7 +63,7 @@ my-app/
 
 Registered as a program with `build.outputs: [public]` plus a `manager: caddy`
 deployment (`root: public`, derived **kind: static**), so the
-gateway serves `public/` in place at `/my-app/` — no service, no process.
+gateway serves `public/` in place at `<name>.<gateway.domain>` (its own subdomain root) — no service, no process.
 
 ## supabase.app.yaml
 
@@ -161,7 +161,7 @@ service itself is likewise at `supabase.<gateway.domain>`.) See
 castle program create my-app --stack supabase --description "..."   # scaffold + register
 castle program build my-app        # apply unapplied migrations to the substrate
 castle program test  my-app        # deno test over functions/ (if deno present)
-castle apply    # serve the static UI at /my-app/
+castle apply    # serve the static UI at <name>.<gateway.domain>
 ```
 
 ## Scaffolding