Public toggle composes for static frontends; document the deployment model

- A static service is inherently exposed, so `public: true` no longer trips the
  "requires proxy" validator — frontends can be public via the tunnel for free
  (the original friction that started this refactor, now resolved).
- docs/registry.md: the manager model (systemd/caddy/path/none), the runner→manager
  table incl. static/path, and behavior as a derived display label.

core/tests/test_tunnel.py

@@ -68,3 +68,15 @@ def test_none_when_no_public_services() -> None:
 def test_none_when_tunnel_unconfigured() -> None:
     assert generate_tunnel_config(_registry(tunnel_id=None)) is None
     assert generate_tunnel_config(_registry(public_domain=None)) is None
+
+
+def test_public_static_frontend_gets_ingress() -> None:
+    # A `static` (frontend) service can be public too — the toggle composes for
+    # any exposed deployment, process-backed or not.
+    reg = _registry(deployed={
+        "guestbook": Deployment(runner="static", run_cmd=[], subdomain="guestbook",
+                               static_root="/data/repos/guestbook/public", public=True),
+    })
+    hosts = {r["hostname"] for r in yaml.safe_load(generate_tunnel_config(reg))["ingress"]
+             if "hostname" in r}
+    assert hosts == {"guestbook.pub.payne.io"}