Fix proxy-providers: bypass clash.yaml for Mihomo provider refresh requests

When Mihomo fetches proxy-providers it sends a Clash UA, causing nginx to
return clash.yaml instead of the actual proxy list — resulting in empty groups.

Fix: proxy-providers in clash.yaml now send X-Proxy-Provider: true header.
nginx map checks combined key "$is_clash_ua:$http_x_proxy_provider":
- Clash UA with no header ("1:") → serve clash.yaml (initial import)
- Clash UA with header present  → pass through to x-ui sub port (provider refresh)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

assets/clash/clash.yaml

@@ -64,6 +64,9 @@ proxy-providers:
     url: https://${DOMAIN}/${SUB_PATH}/${SUB_ID}
     path: ./proxy_providers/base64.yml
     interval: 3600
+    header:
+      X-Proxy-Provider:
+        - "true"
     health-check:
       enable: true
       url: https://www.gstatic.com/generate_204