Dashboard: editable gateway settings + public-exposure panel

Surfaces the DNS/Cloudflare/public state that previously required editing
castle.yaml + curl:

- API: GET /gateway now returns domain, public_domain, tunnel_id,
  tunnel_connected, and a public_url per public route; new PUT /gateway/config
  edits tls/domain/public_domain/tunnel_id in castle.yaml (deploy to apply).
  save_config now persists public_domain/tunnel_id (previously dropped).
- UI: a GatewaySettings row in the Gateway panel shows TLS / domain / public
  (tunnel up/down + public_domain) with inline edit; each public route gets a
  green "public" badge linking to its <name>.<public_domain> URL.

core/src/castle_core/config.py

@@ -427,6 +427,10 @@ def save_config(config: CastleConfig) -> None:
     # Only persist the provider when non-default, to keep castle.yaml minimal.
     if config.gateway.acme_dns_provider and config.gateway.acme_dns_provider != "cloudflare":
         gateway_data["acme_dns_provider"] = config.gateway.acme_dns_provider
+    if config.gateway.public_domain:
+        gateway_data["public_domain"] = config.gateway.public_domain
+    if config.gateway.tunnel_id:
+        gateway_data["tunnel_id"] = config.gateway.tunnel_id
     data: dict = {"gateway": gateway_data}
     if config.repo:
         data["repo"] = str(config.repo)