Add h2/http1.1 ALPN to tls hosts; make raw diag link self-authorize

Host ALPN: ws/xhttp/trojan hosts now advertise ["h2","http/1.1"];
reality host gets [] (its ALPN comes from the reality stream).

Diagnostics access: opening the diag path directly without the
diag_key cookie previously 404'd, so a bookmarked link only worked
after manually visiting /<panel_path>/diag. Now the diag page
302-bounces unauthenticated hits through the SSO bridge, which
validates the 3x-ui panel session and mints the cookie, then redirects
back - so the link works once you're logged into the panel. API and
asset sub-locations still 404 without the cookie (only the HTML page
redirects, never XHR/asset requests).

Verified end to end with nginx + the auth semantics of the installed
3x-ui v3.4.2: logged-in raw hit resolves to the page with no loop,
anonymous hit lands on the panel login.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

x-ui-patch.sh

@@ -392,8 +392,10 @@ server {
         proxy_intercept_errors off;
     }
 
+    # No diag cookie yet → bounce through the SSO bridge (checks panel session,
+    # mints the cookie) so a bookmarked diag link works once logged into the panel.
     location ^~ ${diag_path} {
-        if (\$diag_auth = 0) { return 404; }
+        if (\$diag_auth = 0) { return 302 /${panel_path}/diag; }
         limit_req  zone=diag_page burst=10 nodelay;
         limit_conn per_ip 5;
         alias /var/www/diagnostics/;