diag host: real path prefixes for every UI, and an index page served as a file

Each service now runs behind the prefix it is published under (-http.pathPrefix, or route-prefix plus
external-url for Alertmanager). Without that, three of the four UIs would have loaded at their sub-path and
then fetched their assets from the domain root, so the pages would have come up broken. The prefixes cascade,
so the scrape paths, vmalert's notifier and remote-write URLs, and the deadman's health probes all follow.

The index is diag/index.html mounted into Caddy, not an inline respond: Caddy reads {...} as placeholders and
the page's CSS is full of braces, so inline would have been mangled. It also matches how the gateway, dock and
clips pages are already served.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

observability/scrape.yml

@@ -18,5 +18,13 @@ scrape_configs:
     metrics_path: /logs/metrics    # it runs behind -http.pathPrefix=/logs
   - job_name: victoriametrics
     static_configs: [{targets: ["127.0.0.1:8428"]}]
+    metrics_path: /metrics-db/metrics
   - job_name: alertmanager
     static_configs: [{targets: ["alertmanager:9093"]}]
+    metrics_path: /alerts/metrics
+  - job_name: vmalert
+    static_configs: [{targets: ["vmalert-metrics:8880"], labels: {rules: metrics}}]
+    metrics_path: /rules-metrics/metrics
+  - job_name: vmalert-logs
+    static_configs: [{targets: ["vmalert-logs:8881"], labels: {rules: logs}}]
+    metrics_path: /rules-logs/metrics