Flatten proxy config to a bool (drop the caddy key)

CaddySpec had only `enable` left (path_prefix/host removed; extra_snippets was
unused), so `proxy: { caddy: {} }` was three levels of nesting for a checkbox —
and it invited drift (supabase silently reverted to proxy.caddy.host). Replace it
with a plain `ServiceSpec.proxy: bool`.

- Model: remove ProxySpec/CaddySpec; `proxy: bool = False`. Readers simplified to
  `bool(svc.proxy)` (generator, castle-api summaries, CLI info).
- CLI create / dashboard editor + create form: write `proxy: true` / a checkbox.
- Configs migrated to `proxy: true` (and supabase's stale proxy.caddy.host block
  removed).
- Docs (registry, dns-and-tls, design, stack guides) + tests/fixtures updated;
  also fixed lingering path-model staleness in the stack guides.

docs/stacks/supabase.md

@@ -117,11 +117,12 @@ the function holds credentials and can meter usage.
 
 ## Gateway & secure context
 
-A `public` app is fine on the gateway's HTTP static route at `/my-app/`. An app
-that uses **auth or WebCrypto** needs a **secure context**, so give it its own
-HTTPS host route instead — `proxy.caddy.host: my-app.lan` with `gateway.tls:
-internal` — exactly like the substrate itself (`supabase.lan`). See the "HTTPS for
-host routes" section of @docs/registry.md.
+A supabase app is a `frontend` program (its `public/` is served in place), so the
+gateway serves it at its own subdomain `<name>.<gateway.domain>`. With
+`gateway.tls: acme` that subdomain is HTTPS — a **secure context**, which apps
+using **auth or WebCrypto** require — with no private CA to install. (The substrate
+service itself is likewise at `supabase.<gateway.domain>`.) See
+@docs/dns-and-tls.md.
 
 ## Commands