Gate diagnostics behind 3x-ui panel login via nginx SSO bridge

The 3x-ui session cookie is Path-scoped to the panel base path, so the
diag vhost locations can never see it directly. Instead a bridge
location under the panel path (/<panel_path>/diag) validates the
session with auth_request against GET <basePath>/panel/ (sent with
X-Requested-With: XMLHttpRequest so 3x-ui answers 401 instead of a
login redirect), then issues a path-scoped diag_key cookie and
redirects to the diagnostics page. All diag locations return 404
without that cookie.

auth_request runs in the access phase while "return" runs in the
rewrite phase, so the success path hops through try_files to a named
location; the cookie is set only there, never on the 401 redirect.

Replaces the previous ?key= token link, which is removed entirely.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CLAUDE.md

@@ -37,7 +37,13 @@ effect on servers only after push to `main`.
    Clash/Mihomo user agents get generated clash.yaml, `?provider=1` bypasses it
 10. Downloads a random fake cover site (`install_fake_site`) → `/var/www/html/`
 11. Installs network diagnostics (`install_diagnostics`) → `/var/www/diagnostics/` +
-    `mtr-backend` systemd service (hardened, dedicated user, localhost-only)
+    `mtr-backend` systemd service (hardened, dedicated user, localhost-only).
+    Access only via `/<panel_path>/diag` (SSO bridge): nginx auth_request validates
+    the 3x-ui session against `GET <basePath>/panel/` (with X-Requested-With header →
+    401 instead of login redirect), then issues a path-scoped `diag_key` cookie and
+    redirects to the diag page; all diag locations 404 without that cookie.
+    The 3x-ui session cookie is Path-scoped to the panel base path, which is why
+    the bridge must live under the panel path
 12. Tunes kernel/BBR (`tune_system`)
 13. Sets up cron (`setup_cron`) — daily x-ui restart + nginx reload; monthly certbot renew
     with pre/post hooks stopping/starting nginx (certs are standalone-issued)