diag host: real path prefixes for every UI, and an index page served as a file

Each service now runs behind the prefix it is published under (-http.pathPrefix, or route-prefix plus
external-url for Alertmanager). Without that, three of the four UIs would have loaded at their sub-path and
then fetched their assets from the domain root, so the pages would have come up broken. The prefixes cascade,
so the scrape paths, vmalert's notifier and remote-write URLs, and the deadman's health probes all follow.

The index is diag/index.html mounted into Caddy, not an inline respond: Caddy reads {...} as placeholders and
the page's CSS is full of braces, so inline would have been mangled. It also matches how the gateway, dock and
clips pages are already served.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -72,6 +72,7 @@ services:
       - ./dock:/srv/dock:ro
       - ./clips:/srv/clips:ro               # clip-intake self-service page
       - ./about:/srv/about:ro               # gateway page (/about)
+      - ./diag:/srv/diag:ro                 # diagnostics index (diag.HOST)
       - /srv/live:/srv/live:ro              # live portal static build (deployLive.sh)
       - caddy_data:/data
       - caddy_config:/config
@@ -395,6 +396,7 @@ services:
       - -storageDataPath=/data
       - -retentionPeriod=90d
       - -httpListenAddr=:8428
+      - -http.pathPrefix=/metrics-db   # served at diag.HOST/metrics-db, so its own UI must emit that prefix
       - -promscrape.config=/etc/vm/scrape.yml
       - -promscrape.config.strictParse=false
     ports:
@@ -412,11 +414,12 @@ services:
     image: docker.io/victoriametrics/vmalert:latest
     container_name: vmalert-metrics
     command:
-      - -datasource.url=http://victoriametrics:8428
-      - -notifier.url=http://alertmanager:9093
-      - -remoteWrite.url=http://victoriametrics:8428
+      - -datasource.url=http://victoriametrics:8428/metrics-db
+      - -notifier.url=http://alertmanager:9093/alerts
+      - -remoteWrite.url=http://victoriametrics:8428/metrics-db
       - -rule=/etc/alerts/alerts-metrics.yml
       - -httpListenAddr=:8880
+      - -http.pathPrefix=/rules-metrics
       - -evaluationInterval=1m
     ports:
       - "127.0.0.1:8880:8880"
@@ -436,10 +439,11 @@ services:
     # LogsQL stats endpoints, which answer in the Prometheus format vmalert expects.
     command:
       - -datasource.url=http://victorialogs:9428/logs
-      - -notifier.url=http://alertmanager:9093
-      - -remoteWrite.url=http://victoriametrics:8428
+      - -notifier.url=http://alertmanager:9093/alerts
+      - -remoteWrite.url=http://victoriametrics:8428/metrics-db
       - -rule=/etc/alerts/alerts-logs.yml
       - -httpListenAddr=:8881
+      - -http.pathPrefix=/rules-logs
       - -evaluationInterval=2m
     ports:
       - "127.0.0.1:8881:8881"
@@ -459,6 +463,8 @@ services:
       - --config.file=/etc/alertmanager/alertmanager.yml
       - --storage.path=/data
       - --web.listen-address=:9093
+      - --web.route-prefix=/alerts
+      - --web.external-url=https://${DIAG_HOST:-diag.example.com}/alerts
     ports:
       - "127.0.0.1:9093:9093"
     volumes: