Remove stale TLSMode/HttpPublic exposure vestige

TLSMode (off/internal/letsencrypt) was only referenced by HttpPublic.tls,
and HttpPublic (the expose.http.public field, still carrying a path_prefix
and a tls defaulting to the deleted internal mode) was referenced by no
config, generator, deploy code, or test — a leftover from the pre-proxy:bool
exposure design. Drop the enum, the model, the public field, and both CLI
shim re-exports.

cli/src/castle_cli/manifest.py

@@ -10,7 +10,6 @@ from castle_core.manifest import (  # noqa: F401 — explicit re-exports for typ
     ExposeSpec,
     HttpExposeSpec,
     HttpInternal,
-    HttpPublic,
     JobSpec,
     ManageSpec,
     ProgramSpec,
@@ -26,5 +25,4 @@ from castle_core.manifest import (  # noqa: F401 — explicit re-exports for typ
     RunSpec,
     ServiceSpec,
     SystemdSpec,
-    TLSMode,
 )

core/src/castle_core/manifest.py

@@ -16,12 +16,6 @@ class RestartPolicy(str, Enum):
     ALWAYS = "always"
 
 
-class TLSMode(str, Enum):
-    OFF = "off"
-    INTERNAL = "internal"
-    LETSENCRYPT = "letsencrypt"
-
-
 # ---------------------
 # Run specs (discriminated union)
 # ---------------------
@@ -129,15 +123,8 @@ class HttpInternal(BaseModel):
     unix_socket: str | None = None
 
 
-class HttpPublic(BaseModel):
-    hostnames: list[str] = Field(min_length=1)
-    path_prefix: str = "/"
-    tls: TLSMode = TLSMode.INTERNAL
-
-
 class HttpExposeSpec(BaseModel):
     internal: HttpInternal
-    public: HttpPublic | None = None
     health_path: str | None = None