Fix installer bugs, version-aware http2 directive, cleaner results screen

Bug fixes:
- Root check: exit with message instead of "sudo su -" (which continued
  the script as non-root after the shell exited)
- Move destructive cleanup into clean_previous_install(), called after
  domain validation - wrong args no longer wipe a working install
- x25519 keygen: use xray-linux-$(_arch) instead of hardcoded amd64,
  with fallback for renamed ARM binaries
- Cert renewal: certs are standalone-issued, so renew with pre/post
  hooks stopping nginx instead of --nginx (which could not bind :80)
- Drop ngx_stream_geoip2 load_module insertion: module was never
  installed or used and broke nginx -t when the .so was absent
- emoji_flag: 10s curl timeout + fallback when ipwho.is unavailable
- Uninstall: rm -f /usr/bin/x-ui (trailing slash made rm fail on file)

nginx >= 1.25.1 deprecates "listen ... http2"; emit "http2 on;" there
and keep the old syntax on older versions (Debian 12, Ubuntu 24.04).

Results screen: drop certbot/ssl cert dumps and Clash sub links, keep
panel URL + credentials + diagnostics. Update CLAUDE.md to current
repo state.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CLAUDE.md

@@ -6,47 +6,63 @@ Refactored single-file installer for 3x-ui VPN panel (based on x-ui-pro).
 
 ```
 x-ui-latest.sh          — main installer script (single file, run remotely)
+x-ui-patch.sh           — apply current features to an existing install (no DB changes)
 assets/
+  backup/x-ui-backup.sh — backup / restore / list script
+  clash/clash.yaml      — Clash/Mihomo subscription template (served by UA sniffing)
+  diagnostics/
+    index.html          — network diagnostics page (speed test, MTR, test files)
+    mtr-backend.py      — localhost-only backend: MTR, LibreSpeed endpoints, clash.yaml generator
+    librespeed/         — vendored LibreSpeed engine (speedtest.js, speedtest_worker.js, LGPL)
   fake-sites/
-    site-01/ … site-50/ — static HTML cover pages (index.html per site)
-x-ui-installer/         — reference project (do not modify)
-x-ui-pro/               — original project (do not modify)
+    site-01 … site-50/  — static HTML cover pages (index.html per site)
 ```
 
-## What the script does
+Scripts download assets at install time from this repo's raw GitHub URL
+(`https://raw.githubusercontent.com/mozaroc/3x-ui-pro/main/...`) — changes take
+effect on servers only after push to `main`.
 
-1. Stops / cleans any previous install
+## What x-ui-latest.sh does
+
+1. Checks OS (Ubuntu 24.04/26.04, Debian 12/13) and rejects QEMU-emulated CPUs
 2. Parses CLI arguments (`-install y`, `-subdomain`, `-reality_domain`, `-auto_domain y`, `-uninstall y`)
-3. Installs packages (`install_packages`) — nginx-full, certbot, sqlite3, curl, wget, jq, ufw
-4. Obtains Let's Encrypt certs via certbot standalone (`get_ssl_certs`) — two domains: panel + reality
-5. Installs 3x-ui panel from MHSanaei/3x-ui latest release (`install_panel`)
-6. Configures nginx (`configure_nginx`) — SNI stream, per-domain vhosts, shared includes snippet
-7. Pushes all settings and inbounds into x-ui.db (`configure_xui_db`) — untouched from original
-8. Downloads a random fake cover site from this repo (`install_fake_site`) → `/var/www/html/`
-9. Tunes kernel/BBR (`tune_system`)
-10. Sets up cron (`setup_cron`) — daily x-ui restart + nginx reload, monthly certbot renew
-11. Configures UFW (`setup_firewall`) — 22/80/443 tcp, 443 udp
-12. Prints panel URL + credentials (`show_results`)
+3. Validates domains (panel ≠ REALITY), then stops/cleans any previous install
+4. Installs packages (`install_packages`) — nginx-full, certbot, sqlite3, ufw, mtr, python3 …
+5. Obtains Let's Encrypt certs via certbot standalone (`get_ssl_certs`) — panel + reality domains
+6. Installs 3x-ui panel from MHSanaei/3x-ui latest release (`install_panel`)
+7. Configures nginx (`configure_nginx`) — SNI stream (443 → reality:8443 / panel:7443),
+   per-domain vhosts, shared includes snippet, rate-limit zones
+8. Pushes all settings and inbounds into x-ui.db (`configure_xui_db`)
+9. Installs Clash subscription template (`install_clash_sub`) → `/var/www/subpage/clash.yaml.tpl`;
+   Clash/Mihomo user agents get generated clash.yaml, `?provider=1` bypasses it
+10. Downloads a random fake cover site (`install_fake_site`) → `/var/www/html/`
+11. Installs network diagnostics (`install_diagnostics`) → `/var/www/diagnostics/` +
+    `mtr-backend` systemd service (hardened, dedicated user, localhost-only)
+12. Tunes kernel/BBR (`tune_system`)
+13. Sets up cron (`setup_cron`) — daily x-ui restart + nginx reload; monthly certbot renew
+    with pre/post hooks stopping/starting nginx (certs are standalone-issued)
+14. Configures UFW (`setup_firewall`) — 22/80/443 tcp, 443 udp
+15. Prints panel URL + credentials (`show_results`)
 
-## What was intentionally removed vs original
+## Speed test (LibreSpeed)
 
-- `sub2singbox` binary install and `@reboot` cron entry
-- Custom web subscription page (`/var/www/subpage`, clash.yaml, sub-3x-ui.html)
-- `web_path` and `sub2singbox_path` nginx locations
-- Call to external `randomfakehtml.sh` → replaced with `install_fake_site()` using local assets
+Upload over HTTP/2 is throttled per-stream by the h2 flow-control window, so a
+single big POST measures ~4x low. The diagnostics page uses the vendored
+LibreSpeed engine: parallel streams, XHR-progress measurement, no telemetry, no
+database. h2 must stay enabled on the vhosts — trojan-gRPC needs it. Endpoints:
+download = static `testfiles/test-100m.bin`; upload = `api/st/up` (Python sink,
+`proxy_request_buffering off`); ping = `api/st/ping` (nginx `return 200`);
+IP = `api/st/getip`. Speedtest locations use `limit_conn`, not `limit_req`
+(the engine fires many requests).
 
 ## Inbounds created
 
-| Protocol     | Port          | Transport |
-|--------------|---------------|-----------|
-| vless        | 8443          | REALITY / TCP |
-| vless        | `$ws_port`    | WebSocket  |
-| vless        | UDS socket    | XHTTP (gRPC) |
-| trojan        | `$trojan_port`| gRPC       |
-
-## GitHub raw URL for fake sites
-
-`https://raw.githubusercontent.com/mozaroc/3x-ui-pro/main/assets/fake-sites/site-NN/index.html`
+| Protocol | Port           | Transport      |
+|----------|----------------|----------------|
+| vless    | 8443           | REALITY / TCP  |
+| vless    | `$ws_port`     | WebSocket      |
+| vless    | UDS socket     | XHTTP (gRPC)   |
+| trojan   | `$trojan_port` | gRPC           |
 
 ## Running
 
@@ -54,3 +70,9 @@ x-ui-pro/               — original project (do not modify)
 bash <(curl -fsSL https://raw.githubusercontent.com/mozaroc/3x-ui-pro/main/x-ui-latest.sh) \
   -install y -subdomain panel.example.com -reality_domain r.example.com
 ```
+
+Patch an existing install (re-reads ports/paths from x-ui.db and nginx):
+
+```bash
+bash <(curl -fsSL https://raw.githubusercontent.com/mozaroc/3x-ui-pro/main/x-ui-patch.sh)
+```