Flatten proxy config to a bool (drop the caddy key)

CaddySpec had only `enable` left (path_prefix/host removed; extra_snippets was
unused), so `proxy: { caddy: {} }` was three levels of nesting for a checkbox —
and it invited drift (supabase silently reverted to proxy.caddy.host). Replace it
with a plain `ServiceSpec.proxy: bool`.

- Model: remove ProxySpec/CaddySpec; `proxy: bool = False`. Readers simplified to
  `bool(svc.proxy)` (generator, castle-api summaries, CLI info).
- CLI create / dashboard editor + create form: write `proxy: true` / a checkbox.
- Configs migrated to `proxy: true` (and supabase's stale proxy.caddy.host block
  removed).
- Docs (registry, dns-and-tls, design, stack guides) + tests/fixtures updated;
  also fixed lingering path-model staleness in the stack guides.

core/src/castle_core/generators/caddyfile.py

@@ -61,7 +61,7 @@ def service_proxy_targets(name: str, svc: ServiceSpec) -> ProxyTargets:
     port = None
     if svc.expose and svc.expose.http:
         port = svc.expose.http.internal.port
-    expose = bool(svc.proxy and svc.proxy.caddy and svc.proxy.caddy.enable)
+    expose = bool(svc.proxy)
     base_url = getattr(svc.run, "base_url", None)
     return expose, port, base_url
 

core/src/castle_core/manifest.py

@@ -145,18 +145,6 @@ class ExposeSpec(BaseModel):
     http: HttpExposeSpec | None = None
 
 
-class CaddySpec(BaseModel):
-    # The "expose" checkbox: when present and enabled, the gateway routes
-    # <service-name>.<gateway.domain> to this service (whole host → backend root).
-    # The subdomain is always the service name — rename the service to change it.
-    enable: bool = True
-    extra_snippets: list[str] = Field(default_factory=list)
-
-
-class ProxySpec(BaseModel):
-    caddy: CaddySpec | None = None
-
-
 # ---------------------
 # Build spec
 # ---------------------
@@ -277,7 +265,9 @@ class ServiceSpec(BaseModel):
     run: RunSpec
 
     expose: ExposeSpec | None = None
-    proxy: ProxySpec | None = None
+    # Expose this service at <service-name>.<gateway.domain> through the gateway
+    # (the subdomain is the service name). False → reachable only at its host:port.
+    proxy: bool = False
     manage: ManageSpec | None = None
     defaults: DefaultsSpec | None = None