apply creates the observability data dirs; Caddyfile.example regenerated with the diag block

Without those three directories Docker creates them root-owned and victorialogs, victoriametrics (uid 1000)
and alertmanager (65534) cannot write, so the apply has to make them the way it already makes /srv/bot.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Caddyfile.example

@@ -49,6 +49,11 @@ name:   {http.request.header.X-Authentik-Name}"
 	}
 }
 
+# vanguard:apex
+example.com {
+	redir https://media.example.com/ 302
+}
+
 # vanguard:files
 files.example.com {
 	encode zstd gzip
@@ -77,7 +82,7 @@ files.example.com {
 	# copyparty at the root. It honours X-Authentik-Username / -Groups only when the request also carries a header
 	# whose secret NAME only this proxy knows (copyparty idp-h-key). Clients cannot forge identity.
 	reverse_proxy 127.0.0.1:3923 {
-		header_up X-Vanguard-k 1
+		header_up X-Vanguard-EXAMPLEKEY 1
 		flush_interval -1
 	}
 }
@@ -202,15 +207,9 @@ diag.example.com {
 		reverse_proxy 127.0.0.1:8881          # vmalert over VictoriaLogs
 	}
 	handle {
-		respond "Vanguard diagnostics
-
-/logs            logs (VictoriaLogs)
-/metrics-db      metrics (VictoriaMetrics)
-/alerts          what is firing (Alertmanager)
-/rules-metrics   metric rules (vmalert)
-/rules-logs      log rules (vmalert)
-
-Alerts go to Discord. The deadman runs on the host and watches this stack." 200
+		root * /srv/diag
+		try_files {path} /index.html
+		file_server                           # diag/index.html: what each path above is
 	}
 }