diag host: real path prefixes for every UI, and an index page served as a file

Each service now runs behind the prefix it is published under (-http.pathPrefix, or route-prefix plus
external-url for Alertmanager). Without that, three of the four UIs would have loaded at their sub-path and
then fetched their assets from the domain root, so the pages would have come up broken. The prefixes cascade,
so the scrape paths, vmalert's notifier and remote-write URLs, and the deadman's health probes all follow.

The index is diag/index.html mounted into Caddy, not an inline respond: Caddy reads {...} as placeholders and
the page's CSS is full of braces, so inline would have been mangled. It also matches how the gateway, dock and
clips pages are already served.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

configure.py

@@ -249,15 +249,9 @@ def write_caddy(domain, auth_host="", watch_host="", git_host="", bot_host="", l
 		reverse_proxy 127.0.0.1:8881          # vmalert over VictoriaLogs
 	}}
 	handle {{
-		respond "Vanguard diagnostics
-
-/logs            logs (VictoriaLogs)
-/metrics-db      metrics (VictoriaMetrics)
-/alerts          what is firing (Alertmanager)
-/rules-metrics   metric rules (vmalert)
-/rules-logs      log rules (vmalert)
-
-Alerts go to Discord. The deadman runs on the host and watches this stack." 200
+		root * /srv/diag
+		try_files {{path}} /index.html
+		file_server                           # diag/index.html: what each path above is
 	}}
 }}
 """