diag host: real path prefixes for every UI, and an index page served as a file

Each service now runs behind the prefix it is published under (-http.pathPrefix, or route-prefix plus
external-url for Alertmanager). Without that, three of the four UIs would have loaded at their sub-path and
then fetched their assets from the domain root, so the pages would have come up broken. The prefixes cascade,
so the scrape paths, vmalert's notifier and remote-write URLs, and the deadman's health probes all follow.

The index is diag/index.html mounted into Caddy, not an inline respond: Caddy reads {...} as placeholders and
the page's CSS is full of braces, so inline would have been mangled. It also matches how the gateway, dock and
clips pages are already served.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

bin/vanguard-deadman.sh

@@ -35,11 +35,13 @@ alive() {   # alive <label> <url>
   [[ $code == 2* || $code == 3* ]] || note "$1 is not answering (HTTP ${code:-no response})"
 }
 
-alive "VictoriaLogs"    "http://127.0.0.1:9428/logs/health"
-alive "VictoriaMetrics" "http://127.0.0.1:8428/health"
-alive "vmalert (metrics)" "http://127.0.0.1:8880/health"
-alive "vmalert (logs)"    "http://127.0.0.1:8881/health"
-alive "Alertmanager"    "http://127.0.0.1:9093/-/healthy"
+# Each service runs behind the path prefix it is published under on diag.HOST, so its health endpoint
+# lives under that prefix too.
+alive "VictoriaLogs"      "http://127.0.0.1:9428/logs/health"
+alive "VictoriaMetrics"   "http://127.0.0.1:8428/metrics-db/health"
+alive "vmalert (metrics)" "http://127.0.0.1:8880/rules-metrics/health"
+alive "vmalert (logs)"    "http://127.0.0.1:8881/rules-logs/health"
+alive "Alertmanager"      "http://127.0.0.1:9093/alerts/-/healthy"
 
 # 2. the heartbeat. A missing file right after a restart is not yet a fault, so only age counts.
 if [[ -f $HEARTBEAT ]]; then