Remove stale TLSMode/HttpPublic exposure vestige

TLSMode (off/internal/letsencrypt) was only referenced by HttpPublic.tls,
and HttpPublic (the expose.http.public field, still carrying a path_prefix
and a tls defaulting to the deleted internal mode) was referenced by no
config, generator, deploy code, or test — a leftover from the pre-proxy:bool
exposure design. Drop the enum, the model, the public field, and both CLI
shim re-exports.

cli/src/castle_cli/manifest.py

@@ -10,7 +10,6 @@ from castle_core.manifest import (  # noqa: F401 — explicit re-exports for typ
     ExposeSpec,
     HttpExposeSpec,
     HttpInternal,
-    HttpPublic,
     JobSpec,
     ManageSpec,
     ProgramSpec,
@@ -26,5 +25,4 @@ from castle_core.manifest import (  # noqa: F401 — explicit re-exports for typ
     RunSpec,
     ServiceSpec,
     SystemdSpec,
-    TLSMode,
 )