Flatten proxy config to a bool (drop the caddy key)

CaddySpec had only `enable` left (path_prefix/host removed; extra_snippets was
unused), so `proxy: { caddy: {} }` was three levels of nesting for a checkbox —
and it invited drift (supabase silently reverted to proxy.caddy.host). Replace it
with a plain `ServiceSpec.proxy: bool`.

- Model: remove ProxySpec/CaddySpec; `proxy: bool = False`. Readers simplified to
  `bool(svc.proxy)` (generator, castle-api summaries, CLI info).
- CLI create / dashboard editor + create form: write `proxy: true` / a checkbox.
- Configs migrated to `proxy: true` (and supabase's stale proxy.caddy.host block
  removed).
- Docs (registry, dns-and-tls, design, stack guides) + tests/fixtures updated;
  also fixed lingering path-model staleness in the stack guides.

docs/stacks/python-fastapi.md

@@ -123,8 +123,7 @@ services:
       http:
         internal: { port: 9001 }
         health_path: /health
-    proxy:
-      caddy: { path_prefix: /my-service }
+    proxy: true   # expose at my-service.<gateway.domain>
     manage:
       systemd: {}
 ```

docs/stacks/react-vite.md

@@ -56,9 +56,9 @@ import { defineConfig } from "vite"
 import react from "@vitejs/plugin-react"
 
 export default defineConfig({
-  // Castle sets VITE_BASE to the gateway serve prefix at build time (`/<name>/`,
-  // or `/` for the root app). Reading it here makes the bundle's absolute asset
-  // URLs resolve when served behind the gateway at a subpath — no hand-tuning.
+  // Castle sets VITE_BASE=/ at build time (every frontend serves at its
+  // subdomain root). Reading it here keeps the bundle.s absolute asset
+  // URLs resolving at the root — no hand-tuning.
   base: process.env.VITE_BASE ?? "/",
   plugins: [react(), tailwindcss()],
   resolve: {
@@ -157,8 +157,7 @@ services:
     expose:
       http:
         internal: { port: 5173 }
-    proxy:
-      caddy: {}   # expose the dev server at my-frontend.<gateway.domain>
+    proxy: true   # expose the dev server at my-frontend.<gateway.domain>
 ```
 
 See @docs/registry.md for the full registry reference.

docs/stacks/supabase.md

@@ -117,11 +117,12 @@ the function holds credentials and can meter usage.
 
 ## Gateway & secure context
 
-A `public` app is fine on the gateway's HTTP static route at `/my-app/`. An app
-that uses **auth or WebCrypto** needs a **secure context**, so give it its own
-HTTPS host route instead — `proxy.caddy.host: my-app.lan` with `gateway.tls:
-internal` — exactly like the substrate itself (`supabase.lan`). See the "HTTPS for
-host routes" section of @docs/registry.md.
+A supabase app is a `frontend` program (its `public/` is served in place), so the
+gateway serves it at its own subdomain `<name>.<gateway.domain>`. With
+`gateway.tls: acme` that subdomain is HTTPS — a **secure context**, which apps
+using **auth or WebCrypto** require — with no private CA to install. (The substrate
+service itself is likewise at `supabase.<gateway.domain>`.) See
+@docs/dns-and-tls.md.
 
 ## Commands