Subdomain-only gateway routing; drop path prefixes

Collapse the two proxy shapes (path_prefix + host) to a single checkbox: a
service is either port-only, or exposed at <service-name>.<gateway.domain>. Path
routes and their prefix-stripping foot-guns are gone; the subdomain is always the
service name (rename the service to change it).

- Schema: CaddySpec is just `enable` (presence = expose). service_proxy_targets
  returns (expose, port, base_url); Deployment carries `subdomain` (was
  proxy_path/proxy_host). Registry/deploy/mesh/CLI updated in lockstep.
- Generator: compute_routes emits one host route per exposed service/frontend
  (address = name). acme mode = one *.<domain> site with a reverse_proxy matcher
  per service + a file_server matcher per frontend; the :<port> site redirects to
  the dashboard. off mode = a HTTP control plane on :<port> (dashboard at / +
  /api → castle-api); other services are port-only.
- Dashboard/API: castle-app and castle-api are ordinary subdomains. The dashboard
  derives the API base at runtime (castle-api.<domain> on a subdomain, else /api)
  and calls it cross-origin — castle-api already allows CORS *. Frontends build
  with VITE_BASE=/ (served at their subdomain root).
- CLI: `service create` drops --path/--host; --no-proxy makes it port-only.
- Docs/tests reworked for the model; docs use generic placeholders only (no
  personal host/domain/IP details).

castle-api/tests/conftest.py

@@ -118,7 +118,7 @@ def registry_path(tmp_path: Path, castle_root: Path) -> Generator[Path, None, No
                 behavior="daemon",
                 port=19000,
                 health_path="/health",
-                proxy_path="/test-svc",
+                subdomain="test-svc",
                 managed=True,
             ),
         },

castle-api/tests/test_health.py

@@ -32,7 +32,7 @@ class TestComponents:
         svc = next(c for c in data if c["id"] == "test-svc")
         assert svc["port"] == 19000
         assert svc["health_path"] == "/health"
-        assert svc["proxy_path"] == "/test-svc"
+        assert svc["subdomain"] == "test-svc"
         assert svc["managed"] is True
         assert svc["behavior"] == "daemon"
 
@@ -89,7 +89,7 @@ class TestServicesList:
         svc = next(s for s in data if s["id"] == "test-svc")
         assert svc["port"] == 19000
         assert svc["health_path"] == "/health"
-        assert svc["proxy_path"] == "/test-svc"
+        assert svc["subdomain"] == "test-svc"
         assert svc["managed"] is True
 
     def test_no_schedule_field(self, client: TestClient) -> None:
@@ -255,7 +255,8 @@ class TestGateway:
         """Returns the full route table, tagged with kind + target."""
         response = client.get("/gateway")
         data = response.json()
-        route = next(r for r in data["routes"] if r["address"] == "/test-svc")
+        # Address is the subdomain label (the service name), not a path.
+        route = next(r for r in data["routes"] if r["address"] == "test-svc")
         assert route["kind"] == "proxy"
         assert route["target"] == "localhost:19000"
         assert route["name"] == "test-svc"

castle-api/tests/test_mqtt.py

@@ -20,7 +20,7 @@ def _make_registry() -> NodeRegistry:
                 stack="python-fastapi",
                 port=9001,
                 health_path="/health",
-                proxy_path="/my-svc",
+                subdomain="my-svc",
                 managed=True,
             ),
             "my-job": Deployment(
@@ -54,7 +54,7 @@ class TestRegistrySerialization:
         assert svc.runner == "python"
         assert svc.port == 9001
         assert svc.health_path == "/health"
-        assert svc.proxy_path == "/my-svc"
+        assert svc.subdomain == "my-svc"
         assert svc.managed is True
         assert svc.behavior == "daemon"
         assert svc.stack == "python-fastapi"
@@ -82,7 +82,7 @@ class TestRegistrySerialization:
         bare = restored.deployed["bare"]
         assert bare.port is None
         assert bare.health_path is None
-        assert bare.proxy_path is None
+        assert bare.subdomain is None
         assert bare.schedule is None
         assert bare.managed is False