Add CA download to dashboard: GET /gateway/ca.crt + Gateway-panel button

When the gateway serves internal-CA HTTPS (gateway.tls=internal), other devices
must trust Caddy's root CA to accept *.lan HTTPS. Surface that from the dashboard
instead of hand-copying root.crt around.

- API: GET /gateway/ca.crt returns the public root cert (PEM) as a download,
  sourced from Caddy's admin API (/pki/ca/local — matches the running gateway)
  with an on-disk root.crt fallback. 404 unless tls=internal. GatewayInfo gains
  `tls` and `ca_fingerprint` (SHA-256, for out-of-band verification). The CA
  private key is never exposed — only the public root.
- UI: a "CA cert" button in the Gateway panel, shown only when tls=internal,
  linking to the download with the fingerprint in its tooltip.
- Tests for the tls=off defaults and the 404-without-internal-tls path; docs note
  the button + endpoint.

castle-api/tests/test_health.py

@@ -269,6 +269,17 @@ class TestGateway:
         for r in data["routes"]:
             assert r["kind"] in ("static", "proxy", "remote")
 
+    def test_gateway_tls_off_by_default(self, client: TestClient) -> None:
+        """No TLS configured → tls/ca_fingerprint are null (HTTP-only gateway)."""
+        data = client.get("/gateway").json()
+        assert data["tls"] is None
+        assert data["ca_fingerprint"] is None
+
+    def test_gateway_ca_404_without_internal_tls(self, client: TestClient) -> None:
+        """The CA download is unavailable unless gateway.tls is 'internal'."""
+        response = client.get("/gateway/ca.crt")
+        assert response.status_code == 404
+
 
 class TestConfigEditor:
     """Virtual castle.yaml aggregation/scatter endpoints."""