Add h2/http1.1 ALPN to tls hosts; make raw diag link self-authorize

Host ALPN: ws/xhttp/trojan hosts now advertise ["h2","http/1.1"];
reality host gets [] (its ALPN comes from the reality stream).

Diagnostics access: opening the diag path directly without the
diag_key cookie previously 404'd, so a bookmarked link only worked
after manually visiting /<panel_path>/diag. Now the diag page
302-bounces unauthenticated hits through the SSO bridge, which
validates the 3x-ui panel session and mints the cookie, then redirects
back - so the link works once you're logged into the panel. API and
asset sub-locations still 404 without the cookie (only the HTML page
redirects, never XHR/asset requests).

Verified end to end with nginx + the auth semantics of the installed
3x-ui v3.4.2: logged-in raw hit resolves to the page with no loop,
anonymous hit lands on the panel login.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CLAUDE.md

@@ -42,12 +42,15 @@ effect on servers only after push to `main`.
 10. Downloads a random fake cover site (`install_fake_site`) → `/var/www/html/`
 11. Installs network diagnostics (`install_diagnostics`) → `/var/www/diagnostics/` +
     `mtr-backend` systemd service (hardened, dedicated user, localhost-only).
-    Access only via `/<panel_path>/diag` (SSO bridge): nginx auth_request validates
-    the 3x-ui session against `GET <basePath>/panel/` (with X-Requested-With header →
-    401 instead of login redirect), then issues a path-scoped `diag_key` cookie and
-    redirects to the diag page; all diag locations 404 without that cookie.
-    The 3x-ui session cookie is Path-scoped to the panel base path, which is why
-    the bridge must live under the panel path
+    Access is gated by the 3x-ui panel session via an nginx SSO bridge at
+    `/<panel_path>/diag`: auth_request validates the session against
+    `GET <basePath>/panel/` (with X-Requested-With → 401 instead of a login
+    redirect), then issues a path-scoped `diag_key` cookie and redirects to the
+    diag page. Hitting the diag path directly without the cookie 302-bounces
+    through that bridge, so a bookmarked diag link "just works" once logged into
+    the panel (API/asset sub-locations stay 404 without the cookie). The 3x-ui
+    session cookie is Path-scoped to the panel base path, which is why the bridge
+    must live under the panel path
 12. Tunes kernel/BBR (`tune_system`)
 13. Sets up cron (`setup_cron`) — daily x-ui restart + nginx reload; monthly certbot renew
     with pre/post hooks stopping/starting nginx (certs are standalone-issued)