docs: fix stale TLS/routing references (audit sweep)

Cross-checked every doc against the code and fixed the stragglers the
apply/gateway/subdomain refactors left behind:

- Retired `tls: internal` mode: dropped the misleading reference in
  registry.md and the stale comment in config.py GatewayConfig (only
  off|acme exist; the dns-and-tls.md "was removed" note is kept as
  accurate history).
- Subdomain-only routing: fixed "path-based routing" claims in design.md
  (proxy list + mesh), "path prefix or host" → host, and the "path-prefix
  routes stay on :port" line in registry.md.
- Frontends serve at their subdomain root (VITE_BASE=/), not /<name>/:
  fixed supabase.md (x2), the scaffold.py docstring, the stacks.py build
  comment, and design.md's "serve prefix baked in" line.

README, AGENTS, developing-castle, dns-and-tls audited clean. Verified
against code; core 129 / cli 31 pass; ruff clean.

docs/tunnel-setup.md

@@ -143,7 +143,7 @@ Reachability is the easy half. Anything public also needs, per service:
 ## Notes
 
 - Requires `gateway.tls: acme` (the tunnel forwards to the gateway's real-cert
-  `:443` host sites). On an `off`/`internal` gateway the origin bridge doesn't apply.
+  `:443` host sites). On an `off` (plain-HTTP) gateway the origin bridge doesn't apply.
 - Cloudflare terminates TLS at the edge (it can see plaintext). For a
   no-third-party-in-path variant, the same `public: true` model can drive a
   self-hosted VPS + WireGuard edge instead — the toggle and generator stay; only the