Subdomain-only gateway routing; drop path prefixes

Collapse the two proxy shapes (path_prefix + host) to a single checkbox: a
service is either port-only, or exposed at <service-name>.<gateway.domain>. Path
routes and their prefix-stripping foot-guns are gone; the subdomain is always the
service name (rename the service to change it).

- Schema: CaddySpec is just `enable` (presence = expose). service_proxy_targets
  returns (expose, port, base_url); Deployment carries `subdomain` (was
  proxy_path/proxy_host). Registry/deploy/mesh/CLI updated in lockstep.
- Generator: compute_routes emits one host route per exposed service/frontend
  (address = name). acme mode = one *.<domain> site with a reverse_proxy matcher
  per service + a file_server matcher per frontend; the :<port> site redirects to
  the dashboard. off mode = a HTTP control plane on :<port> (dashboard at / +
  /api → castle-api); other services are port-only.
- Dashboard/API: castle-app and castle-api are ordinary subdomains. The dashboard
  derives the API base at runtime (castle-api.<domain> on a subdomain, else /api)
  and calls it cross-origin — castle-api already allows CORS *. Frontends build
  with VITE_BASE=/ (served at their subdomain root).
- CLI: `service create` drops --path/--host; --no-proxy makes it port-only.
- Docs/tests reworked for the model; docs use generic placeholders only (no
  personal host/domain/IP details).

core/tests/test_manifest.py

@@ -92,9 +92,9 @@ class TestServiceSpec:
         s = ServiceSpec(
             id="svc",
             run=RunPython(runner="python", program="svc"),
-            proxy=ProxySpec(caddy=CaddySpec(path_prefix="/svc")),
+            proxy=ProxySpec(caddy=CaddySpec()),
         )
-        assert s.proxy.caddy.path_prefix == "/svc"
+        assert s.proxy.caddy.enable is True
 
     def test_service_with_manage(self) -> None:
         """Service with systemd management."""
@@ -185,10 +185,10 @@ class TestModelSerialization:
                     internal=HttpInternal(port=9001), health_path="/health"
                 )
             ),
-            proxy=ProxySpec(caddy=CaddySpec(path_prefix="/svc")),
+            proxy=ProxySpec(caddy=CaddySpec()),
             manage=ManageSpec(systemd=SystemdSpec()),
         )
         data = s.model_dump(exclude_none=True, exclude={"id"})
         assert data["run"]["runner"] == "python"
         assert data["expose"]["http"]["internal"]["port"] == 9001
-        assert data["proxy"]["caddy"]["path_prefix"] == "/svc"
+        assert data["proxy"]["caddy"]["enable"] is True