Subdomain-only gateway routing; drop path prefixes

Collapse the two proxy shapes (path_prefix + host) to a single checkbox: a
service is either port-only, or exposed at <service-name>.<gateway.domain>. Path
routes and their prefix-stripping foot-guns are gone; the subdomain is always the
service name (rename the service to change it).

- Schema: CaddySpec is just `enable` (presence = expose). service_proxy_targets
  returns (expose, port, base_url); Deployment carries `subdomain` (was
  proxy_path/proxy_host). Registry/deploy/mesh/CLI updated in lockstep.
- Generator: compute_routes emits one host route per exposed service/frontend
  (address = name). acme mode = one *.<domain> site with a reverse_proxy matcher
  per service + a file_server matcher per frontend; the :<port> site redirects to
  the dashboard. off mode = a HTTP control plane on :<port> (dashboard at / +
  /api → castle-api); other services are port-only.
- Dashboard/API: castle-app and castle-api are ordinary subdomains. The dashboard
  derives the API base at runtime (castle-api.<domain> on a subdomain, else /api)
  and calls it cross-origin — castle-api already allows CORS *. Frontends build
  with VITE_BASE=/ (served at their subdomain root).
- CLI: `service create` drops --path/--host; --no-proxy makes it port-only.
- Docs/tests reworked for the model; docs use generic placeholders only (no
  personal host/domain/IP details).

castle-api/src/castle_api/models.py

@@ -22,7 +22,7 @@ class DeploymentSummary(BaseModel):
     runner: str | None = None
     port: int | None = None
     health_path: str | None = None
-    proxy_path: str | None = None
+    subdomain: str | None = None  # exposed at <subdomain>.<gateway.domain>, else None
     managed: bool = False
     systemd: SystemdInfo | None = None
     version: str | None = None
@@ -53,8 +53,7 @@ class ServiceSummary(BaseModel):
     run_target: str | None = None  # what it runs: program name, argv, image, …
     port: int | None = None
     health_path: str | None = None
-    proxy_path: str | None = None
-    proxy_host: str | None = None
+    subdomain: str | None = None  # exposed at <subdomain>.<gateway.domain>, else None
     managed: bool = False
     systemd: SystemdInfo | None = None
     program: str | None = None  # the program this deployment references, if any

castle-api/src/castle_api/mqtt_client.py

@@ -54,8 +54,8 @@ def _registry_to_json(registry: NodeRegistry) -> str:
             entry["port"] = comp.port
         if comp.health_path:
             entry["health_path"] = comp.health_path
-        if comp.proxy_path:
-            entry["proxy_path"] = comp.proxy_path
+        if comp.subdomain:
+            entry["subdomain"] = comp.subdomain
         if comp.schedule:
             entry["schedule"] = comp.schedule
         if comp.managed:
@@ -85,7 +85,7 @@ def _json_to_registry(payload: str) -> NodeRegistry:
             stack=comp_data.get("stack"),
             port=comp_data.get("port"),
             health_path=comp_data.get("health_path"),
-            proxy_path=comp_data.get("proxy_path"),
+            subdomain=comp_data.get("subdomain"),
             schedule=comp_data.get("schedule"),
             managed=comp_data.get("managed", False),
         )

castle-api/src/castle_api/nodes.py

@@ -53,7 +53,7 @@ def _deployed_to_summaries(registry: object, hostname: str) -> list[DeploymentSu
                 runner=d.runner,
                 port=d.port,
                 health_path=d.health_path,
-                proxy_path=d.proxy_path,
+                subdomain=d.subdomain,
                 managed=d.managed,
                 schedule=d.schedule,
                 node=hostname,

castle-api/src/castle_api/routes.py

@@ -86,7 +86,7 @@ def _summary_from_deployed(name: str, deployed: object) -> DeploymentSummary:
         runner=deployed.runner,
         port=deployed.port,
         health_path=deployed.health_path,
-        proxy_path=deployed.proxy_path,
+        subdomain=deployed.subdomain,
         managed=managed,
         systemd=systemd_info,
         schedule=deployed.schedule,
@@ -100,12 +100,10 @@ def _summary_from_service(
     """Build a DeploymentSummary from a ServiceSpec (non-deployed)."""
     port = None
     health_path = None
-    proxy_path = None
     if svc.expose and svc.expose.http:
         port = svc.expose.http.internal.port
         health_path = svc.expose.http.health_path
-    if svc.proxy and svc.proxy.caddy:
-        proxy_path = svc.proxy.caddy.path_prefix
+    subdomain = name if (svc.proxy and svc.proxy.caddy and svc.proxy.caddy.enable) else None
 
     managed = bool(svc.manage and svc.manage.systemd and svc.manage.systemd.enable)
 
@@ -138,7 +136,7 @@ def _summary_from_service(
         runner=runner,
         port=port,
         health_path=health_path,
-        proxy_path=proxy_path,
+        subdomain=subdomain,
         managed=managed,
         systemd=systemd_info,
         source=source,
@@ -266,8 +264,7 @@ def _service_from_deployed(name: str, deployed: object) -> ServiceSummary:
         run_target=run_target,
         port=deployed.port,
         health_path=deployed.health_path,
-        proxy_path=deployed.proxy_path,
-        proxy_host=deployed.proxy_host,
+        subdomain=deployed.subdomain,
         managed=deployed.managed,
         systemd=systemd_info,
     )
@@ -277,12 +274,11 @@ def _service_from_spec(name: str, svc: ServiceSpec, config: object) -> ServiceSu
     """Build a ServiceSummary from a ServiceSpec."""
     port = None
     health_path = None
-    proxy_path = None
     if svc.expose and svc.expose.http:
         port = svc.expose.http.internal.port
         health_path = svc.expose.http.health_path
-    if svc.proxy and svc.proxy.caddy:
-        proxy_path = svc.proxy.caddy.path_prefix
+    # Exposed at <name>.<domain> when the proxy checkbox is on.
+    subdomain = name if (svc.proxy and svc.proxy.caddy and svc.proxy.caddy.enable) else None
 
     managed = bool(svc.manage and svc.manage.systemd and svc.manage.systemd.enable)
     systemd_info = _make_systemd_info(name) if managed else None
@@ -297,7 +293,6 @@ def _service_from_spec(name: str, svc: ServiceSpec, config: object) -> ServiceSu
         source = comp.source
         stack = comp.stack
 
-    proxy_host = svc.proxy.caddy.host if (svc.proxy and svc.proxy.caddy) else None
     return ServiceSummary(
         id=name,
         description=description,
@@ -306,8 +301,7 @@ def _service_from_spec(name: str, svc: ServiceSpec, config: object) -> ServiceSu
         run_target=_run_target(svc.run),
         port=port,
         health_path=health_path,
-        proxy_path=proxy_path,
-        proxy_host=proxy_host,
+        subdomain=subdomain,
         managed=managed,
         systemd=systemd_info,
         program=svc.program,
@@ -512,7 +506,7 @@ def get_service(name: str) -> ServiceDetail:
             "secret_env_keys": deployed.secret_env_keys,
             "port": deployed.port,
             "health_path": deployed.health_path,
-            "proxy_path": deployed.proxy_path,
+            "subdomain": deployed.subdomain,
             "managed": deployed.managed,
             "behavior": deployed.behavior,
             "stack": deployed.stack,
@@ -762,7 +756,7 @@ def list_components(include_remote: bool = False) -> list[DeploymentSummary]:
                             runner=d.runner,
                             port=d.port,
                             health_path=d.health_path,
-                            proxy_path=d.proxy_path,
+                            subdomain=d.subdomain,
                             managed=d.managed,
                             schedule=d.schedule,
                             node=hostname,
@@ -809,7 +803,7 @@ def get_component(name: str) -> DeploymentDetail:
             "secret_env_keys": deployed.secret_env_keys,
             "port": deployed.port,
             "health_path": deployed.health_path,
-            "proxy_path": deployed.proxy_path,
+            "subdomain": deployed.subdomain,
             "managed": deployed.managed,
             "behavior": deployed.behavior,
             "stack": deployed.stack,