gateway: converge, don't start/stop/reload

The gateway is a deployment (castle-gateway) — its lifecycle is the same
convergence as everything else, so the bespoke start/stop/reload verbs
(which still routed through the retired enable/disable path) are gone.

- CLI: `castle gateway` is now inspection only — bare or `status` shows
  the route table. Start/stop/reload it via `castle apply` (render routes
  + reload) or `castle restart castle-gateway`. Deletes the last users of
  `_service_enable`/`_service_disable`, so those are removed too.
- API: retire `POST /gateway/reload` (making routes live is `POST /apply`);
  `PUT /gateway/config` message + docstring now say apply, not deploy.
- UI: GatewayPanel's "Reload" button → "Apply" (useApply); drop the
  useGatewayReload hook; GatewaySettings points at `castle apply`.
- docs: `castle gateway reload|status` → `castle gateway` (status lens).

core 129 / cli 31 / api 59 pass; dashboard builds clean; live `castle
gateway` shows routes with no start/stop/reload; /gateway/reload removed
from the API.

cli/src/castle_cli/main.py

@@ -159,15 +159,11 @@ def build_parser() -> argparse.ArgumentParser:
     _build_deployment_group(subparsers, "job")
     _build_tool_group(subparsers)
 
-    # Gateway (infrastructure)
-    gw = subparsers.add_parser("gateway", help="Manage the Caddy gateway")
+    # Gateway (inspection). The gateway is a deployment — start/stop/reload it via
+    # `castle apply` / `castle restart castle-gateway`; this lens just shows routes.
+    gw = subparsers.add_parser("gateway", help="Show the gateway's status + route table")
     gw_sub = gw.add_subparsers(dest="gateway_command")
-    p = gw_sub.add_parser("start", help="Start the gateway")
-    p.add_argument("--dry-run", action="store_true")
-    gw_sub.add_parser("stop", help="Stop the gateway")
-    p = gw_sub.add_parser("reload", help="Reload gateway configuration")
-    p.add_argument("--dry-run", action="store_true")
-    gw_sub.add_parser("status", help="Show gateway status")
+    gw_sub.add_parser("status", help="Show gateway status + routes (the default)")
 
     # Convergence — the one lifecycle verb. Renders units/Caddyfile/tunnel, then
     # reconciles the runtime to match config (activate/restart/deactivate).