Dashboard: editable gateway settings + public-exposure panel

Surfaces the DNS/Cloudflare/public state that previously required editing
castle.yaml + curl:

- API: GET /gateway now returns domain, public_domain, tunnel_id,
  tunnel_connected, and a public_url per public route; new PUT /gateway/config
  edits tls/domain/public_domain/tunnel_id in castle.yaml (deploy to apply).
  save_config now persists public_domain/tunnel_id (previously dropped).
- UI: a GatewaySettings row in the Gateway panel shows TLS / domain / public
  (tunnel up/down + public_domain) with inline edit; each public route gets a
  green "public" badge linking to its <name>.<public_domain> URL.

app/src/services/api/hooks.ts

@@ -11,6 +11,7 @@ import type {
   ProgramDetail,
   StatusResponse,
   GatewayInfo,
+  GatewayConfigRequest,
   ServiceActionResponse,
   SSEHealthEvent,
   MeshStatus,
@@ -173,6 +174,17 @@ export function useGatewayReload() {
   })
 }
 
+export function useSaveGatewayConfig() {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: (body: GatewayConfigRequest) =>
+      apiClient.put<{ status: string; message: string }>("/gateway/config", body),
+    onSuccess: () => {
+      qc.invalidateQueries({ queryKey: ["gateway"] })
+    },
+  })
+}
+
 export function useNodes() {
   return useQuery({
     queryKey: ["nodes"],