feat: castle UX fixes from the lakehouse adoption test

Driven by adopting lakehouse (an existing daemon that bundles its own SPA) —
see docs/findings-lakehouse.md.

#3 deploy reloads the gateway. castle deploy regenerated the Caddyfile but
   left the running Caddy on the old config, so new proxy routes were silently
   dead. Deploy now reloads the gateway when it's running.

#1 castle expose <program>. Turns an adopted program into a service
   (run/port/health/proxy/systemd) in one command — the missing
   daemon-to-service step. Flags: --port --health --path --run --port-env
   --host --no-proxy.

#2 port_env mapping. A service can declare expose.http.internal.port_env so
   castle sets the env var the program actually reads (e.g. lakehoused reads
   LAKEHOUSED_DAEMON_PORT, not castle's convention LAKEHOUSE_PORT). Castle now
   genuinely drives an adopted daemon's bind port.

#4a auto-base for react-vite. The build passes VITE_BASE = the gateway serve
   prefix (/<name>/, or / for castle-app); vite.config reads it. A castle-built
   frontend now works at its subpath with no hand-tuned base. castle-app's
   vite.config updated as the reference.

#4b host-based routing. proxy.caddy.host routes a whole hostname to the backend
   root via a host matcher inside the :9000 site, so a root-based SPA (base="/")
   serves unchanged — the fix for proxying an app castle can't rebuild. Caddyfile
   now emits 'auto_https off' (HTTP-only gateway on a non-standard port).

Nit: activate skips the editable reinstall when the tool is already on PATH.

Tests: core 94, cli 24, api 52; ruff + app build clean. Verified live: lakehouse
runs under systemd, API at /lakehouse, full UI (SPA boots) via host routing.

core/src/castle_core/deploy.py

@@ -121,10 +121,37 @@ def deploy(target_name: str | None = None, root: Path | None = None) -> DeployRe
     # Reload systemd daemon
     subprocess.run(["systemctl", "--user", "daemon-reload"], check=False)
 
+    # Reload the gateway so the freshly written Caddyfile takes effect. Without
+    # this, new/changed proxy routes sit on disk but the running Caddy keeps the
+    # old config (a deployed service's route is silently dead until reload).
+    _reload_gateway(result.messages)
+
     result.registry = registry
     return result
 
 
+# Gateway service name in the registry → its systemd unit (castle-castle-gateway).
+_GATEWAY_NAME = "castle-gateway"
+
+
+def _reload_gateway(messages: list[str]) -> None:
+    """Reload Caddy if the gateway is running, so new routes take effect."""
+    gw_unit = unit_name(_GATEWAY_NAME)
+    active = subprocess.run(
+        ["systemctl", "--user", "is-active", gw_unit],
+        capture_output=True,
+        text=True,
+    )
+    if active.stdout.strip() != "active":
+        messages.append("Gateway not running — skipped reload (start it with 'castle gateway start').")
+        return
+    result = subprocess.run(["systemctl", "--user", "reload", gw_unit], capture_output=True, text=True)
+    if result.returncode == 0:
+        messages.append("Gateway reloaded.")
+    else:
+        messages.append(f"Warning: gateway reload failed: {result.stderr.strip()}")
+
+
 # ---------------------------------------------------------------------------
 # Internal helpers
 # ---------------------------------------------------------------------------
@@ -172,6 +199,10 @@ def _build_deployed_service(
     if svc.expose and svc.expose.http:
         port = svc.expose.http.internal.port
         env[f"{prefix}_PORT"] = str(port)
+        # If the program reads a non-convention port var, set that too so castle
+        # actually controls the bind (e.g. adopted lakehoused → LAKEHOUSED_DAEMON_PORT).
+        if svc.expose.http.internal.port_env:
+            env[svc.expose.http.internal.port_env] = str(port)
         health_path = svc.expose.http.health_path
 
     # Merge defaults.env (overrides conventions)
@@ -187,10 +218,18 @@ def _build_deployed_service(
     # Build run_cmd
     run_cmd = _build_run_cmd(name, run, env, messages)
 
-    # Proxy path
+    # Proxy: a path prefix (handle_path on the gateway) and/or a hostname (a
+    # dedicated host site block, so a root-based app serves unchanged).
     proxy_path = None
+    proxy_host = None
     if svc.proxy and svc.proxy.caddy and svc.proxy.caddy.enable:
-        proxy_path = svc.proxy.caddy.path_prefix or f"/{name}"
+        caddy = svc.proxy.caddy
+        proxy_host = caddy.host
+        if caddy.path_prefix:
+            proxy_path = caddy.path_prefix
+        elif not caddy.host:
+            # No explicit path and no host → default to /<name>.
+            proxy_path = f"/{name}"
 
     # Resolve stack from referenced program
     stack = None
@@ -210,6 +249,7 @@ def _build_deployed_service(
         port=port,
         health_path=health_path,
         proxy_path=proxy_path,
+        proxy_host=proxy_host,
         base_url=base_url,
         managed=managed,
     )