TLSMode (off/internal/letsencrypt) was only referenced by HttpPublic.tls, and HttpPublic (the expose.http.public field, still carrying a path_prefix and a tls defaulting to the deleted internal mode) was referenced by no config, generator, deploy code, or test — a leftover from the pre-proxy:bool exposure design. Drop the enum, the model, the public field, and both CLI shim re-exports.