Retire gateway.tls=internal; host routes use a bare subdomain label

acme mode fully replaced the internal-CA path (which required installing a private
CA on every device — the exact pain, esp. on Android, that acme avoids). Remove
`internal` entirely and simplify how services declare host routes.

- Generator (caddyfile.py): drop the `tls internal` branch — modes are now
  `off` | `acme`. In acme mode the published subdomain is the **first DNS label**
  of `proxy.caddy.host` (a bare `claw`, or a legacy `claw.civil.lan`, both →
  `claw.<domain>`), so services stay domain-agnostic and the declared value is
  authoritative again (no more silent service-name override). Shared
  `_host_matcher_block` reused by off-mode and the acme wildcard site.
- castle-api: delete `GET /gateway/ca.crt`, `_gateway_ca_pem`, `_ca_fingerprint`
  and the now-unused imports; drop `ca_fingerprint` from `GatewayInfo` (keep
  `tls`).
- Dashboard: remove the CA-cert download button + unused imports; drop
  `ca_fingerprint` from the `GatewayInfo` type.
- Tests: replace TestCaddyfileTlsInternal with an off-mode class (keeps the
  runner-agnostic host-route coverage); acme tests assert first-label derivation
  incl. label-wins-over-service-name; drop the castle-api CA-endpoint test.
- Docs: registry.md + dns-and-tls.md — two-mode tables (off|acme), remove the
  internal sections/CA-download, document the bare-label host convention; note a
  domain-less node stays on `off`.

castle-api/tests/test_health.py

@@ -270,15 +270,9 @@ class TestGateway:
             assert r["kind"] in ("static", "proxy", "remote")
 
     def test_gateway_tls_off_by_default(self, client: TestClient) -> None:
-        """No TLS configured → tls/ca_fingerprint are null (HTTP-only gateway)."""
+        """No TLS configured → tls is null (HTTP-only gateway)."""
         data = client.get("/gateway").json()
         assert data["tls"] is None
-        assert data["ca_fingerprint"] is None
-
-    def test_gateway_ca_404_without_internal_tls(self, client: TestClient) -> None:
-        """The CA download is unavailable unless gateway.tls is 'internal'."""
-        response = client.get("/gateway/ca.crt")
-        assert response.status_code == 404
 
 
 class TestConfigEditor: