feat: raw-TCP exposure with castle-managed TLS + reach model

Expose raw-TCP services (postgres) by name at <name>.<domain>:<port> and
cut the gateway's ACME wildcard cert onto them so they present a trusted
cert. Replaces the proxy/public booleans with a single `reach` enum
(off|internal|public); legacy input still parses via derived accessors.

Core:
- expose.tcp{port,tls} + TlsSpec(material: pair|combined|off, reload)
- tls.py: materialize cert files from Caddy's wildcard, reconcile on
  renewal; `castle tls` CLI; optional cert_obtained events-exec hook
  (gateway.cert_hook, gated so a plugin-less Caddy still parses)
- apply waits (bounded) for the wildcard to issue before materializing so
  a fresh-node TLS service starts with its cert in place, then scopes
  materialization to the deployments being applied
- reach: internal|public requires an expose block (no silent no-op);
  public raw-TCP guarded until tunnel support lands
- chain.pem (${tls_ca}) is the issuer chain (leaf stripped), a real CA
  bundle distinct from cert.pem
- one shared ${...} resolver (resolve_placeholders) for env and container
  run fields; run.env now expands like volumes/args; $$ escapes a literal
- validate the generated Caddyfile before reloading the gateway so an
  invalid config never degrades routing

Docs: docs/tcp-exposure.md. Tests cover reach/expose validation,
placeholder expansion + escape, issuer-chain material, TLS materialize.

install.sh

@@ -202,15 +202,21 @@ ensure_caddy_dns_plugin() {
             || log_fail "xcaddy install failed"
     fi
 
-    log_info "Building Caddy $CADDY_DNS_VERSION with $module (~1 min)..."
+    # events-exec: lets the gateway run `castle tls reconcile` on cert issuance/
+    # renewal (the cert_obtained hook), so certs materialized onto raw-TCP services
+    # refresh automatically. See docs/tcp-exposure.md §5.
+    local events_module="github.com/mholt/caddy-events-exec"
+    log_info "Building Caddy $CADDY_DNS_VERSION with $module + events-exec (~1 min)..."
     local tmp; tmp="$(mktemp -d)"
-    ( cd "$tmp" && "$gobin/xcaddy" build "$CADDY_DNS_VERSION" --with "$module" ) \
+    ( cd "$tmp" && "$gobin/xcaddy" build "$CADDY_DNS_VERSION" --with "$module" --with "$events_module" ) \
         || { rm -rf "$tmp"; log_fail "xcaddy build failed"; }
     sudo install -m 0755 "$tmp/caddy" /usr/local/bin/caddy || { rm -rf "$tmp"; log_fail "install failed"; }
     rm -rf "$tmp"
 
     /usr/local/bin/caddy list-modules 2>/dev/null | grep -q "dns.providers.$provider" \
         || log_fail "built caddy is missing dns.providers.$provider"
+    /usr/local/bin/caddy list-modules 2>/dev/null | grep -q "events.handlers.exec" \
+        || log_fail "built caddy is missing events.handlers.exec"
     log_info "Built /usr/local/bin/caddy — run 'castle apply' to use it."
     log_ok
 }