gateway: converge, don't start/stop/reload

The gateway is a deployment (castle-gateway) — its lifecycle is the same
convergence as everything else, so the bespoke start/stop/reload verbs
(which still routed through the retired enable/disable path) are gone.

- CLI: `castle gateway` is now inspection only — bare or `status` shows
  the route table. Start/stop/reload it via `castle apply` (render routes
  + reload) or `castle restart castle-gateway`. Deletes the last users of
  `_service_enable`/`_service_disable`, so those are removed too.
- API: retire `POST /gateway/reload` (making routes live is `POST /apply`);
  `PUT /gateway/config` message + docstring now say apply, not deploy.
- UI: GatewayPanel's "Reload" button → "Apply" (useApply); drop the
  useGatewayReload hook; GatewaySettings points at `castle apply`.
- docs: `castle gateway reload|status` → `castle gateway` (status lens).

core 129 / cli 31 / api 59 pass; dashboard builds clean; live `castle
gateway` shows routes with no start/stop/reload; /gateway/reload removed
from the API.

AGENTS.md

@@ -81,7 +81,7 @@ castle list [--kind ...] [--stack ...] [--json]    # all deployments
 castle status                                      # unified health/status
 castle doctor                                      # diagnose setup + runtime, with fix hints
 castle restart [name]                              # imperative bounce (one or all)
-castle gateway reload|status                       # the Caddy gateway
+castle gateway                                     # gateway status + route table (inspection)
 ```
 
 `castle service`/`job`/`tool` are **views** over the one deployment set, filtered
@@ -184,8 +184,8 @@ public: true   # ALSO expose to the internet via Cloudflare tunnel (requires pro
 - There are **no path-prefix routes** — a whole subdomain maps to the backend
   root, so root-relative assets and `window.location` WebSocket URLs just work.
 
-Inspect routes: `castle gateway status` (or `GET /gateway`). Regenerate + reload:
-`castle gateway reload`. → Field-level detail: **`docs/registry.md`**.
+Inspect routes: `castle gateway` / `GET /gateway`. Regenerate routes + reload the
+gateway: `castle apply` (converge). → Field-level detail: **`docs/registry.md`**.
 
 ---