Subdomain-only gateway routing; drop path prefixes

Collapse the two proxy shapes (path_prefix + host) to a single checkbox: a
service is either port-only, or exposed at <service-name>.<gateway.domain>. Path
routes and their prefix-stripping foot-guns are gone; the subdomain is always the
service name (rename the service to change it).

- Schema: CaddySpec is just `enable` (presence = expose). service_proxy_targets
  returns (expose, port, base_url); Deployment carries `subdomain` (was
  proxy_path/proxy_host). Registry/deploy/mesh/CLI updated in lockstep.
- Generator: compute_routes emits one host route per exposed service/frontend
  (address = name). acme mode = one *.<domain> site with a reverse_proxy matcher
  per service + a file_server matcher per frontend; the :<port> site redirects to
  the dashboard. off mode = a HTTP control plane on :<port> (dashboard at / +
  /api → castle-api); other services are port-only.
- Dashboard/API: castle-app and castle-api are ordinary subdomains. The dashboard
  derives the API base at runtime (castle-api.<domain> on a subdomain, else /api)
  and calls it cross-origin — castle-api already allows CORS *. Frontends build
  with VITE_BASE=/ (served at their subdomain root).
- CLI: `service create` drops --path/--host; --no-proxy makes it port-only.
- Docs/tests reworked for the model; docs use generic placeholders only (no
  personal host/domain/IP details).

cli/src/castle_cli/commands/create.py

@@ -121,7 +121,7 @@ def run_create(args: argparse.Namespace) -> int:
                     health_path="/health",
                 )
             ),
-            proxy=ProxySpec(caddy=CaddySpec(path_prefix=f"/{name}")),
+            proxy=ProxySpec(caddy=CaddySpec()),  # expose at <name>.<gateway.domain>
             manage=ManageSpec(systemd=SystemdSpec()),
             # python-fastapi scaffold reads env_prefix MY_SERVICE_ — map castle's
             # computed port/data dir to those vars (explicit, no hidden injection).

cli/src/castle_cli/commands/deploy_create.py

@@ -71,14 +71,8 @@ def run_service_create(args: argparse.Namespace) -> int:
             )
         )
         if not args.no_proxy:
-            path = args.path
-            if args.path:
-                path = args.path if args.path.startswith("/") else f"/{args.path}"
-            elif args.host:
-                path = None
-            else:
-                path = f"/{name}"
-            proxy = ProxySpec(caddy=CaddySpec(path_prefix=path, host=args.host))
+            # Expose at <name>.<gateway.domain> (the subdomain is the service name).
+            proxy = ProxySpec(caddy=CaddySpec())
 
     config.services[name] = ServiceSpec(
         id=name,
@@ -97,10 +91,7 @@ def run_service_create(args: argparse.Namespace) -> int:
     if expose:
         print(f"  port:   {args.port}")
     if proxy and proxy.caddy:
-        if proxy.caddy.path_prefix:
-            print(f"  proxy:  {proxy.caddy.path_prefix}")
-        if proxy.caddy.host:
-            print(f"  host:   {proxy.caddy.host}")
+        print(f"  subdomain: {name}.<gateway.domain>")
     print(f"\nNext: castle service deploy {name} && castle service start {name}")
     return 0
 

cli/src/castle_cli/commands/info.py

@@ -119,10 +119,8 @@ def run_info(args: argparse.Namespace) -> int:
             print(f"  {BOLD}port{RESET}:        {http.internal.port}")
             if http.health_path:
                 print(f"  {BOLD}health{RESET}:      {http.health_path}")
-        if service.proxy and service.proxy.caddy:
-            caddy = service.proxy.caddy
-            if caddy.path_prefix:
-                print(f"  {BOLD}path{RESET}:        {caddy.path_prefix}")
+        if service.proxy and service.proxy.caddy and service.proxy.caddy.enable:
+            print(f"  {BOLD}subdomain{RESET}:   {name}.<gateway.domain>")
         if service.manage and service.manage.systemd:
             sd = service.manage.systemd
             print(f"  {BOLD}systemd{RESET}:     enabled={sd.enable}, restart={sd.restart.value}")