Fix diagnostics SSO deny path returning a 302 with no Location

The bridge used `error_page 401 403 =302 /<panel>/`, which does an
nginx internal redirect: it serves the panel login page body with a
302 status but sends NO Location header. Browsers (and curl) can't
follow that, so an unauthenticated or expired-session visit to the
diag link rendered a blank page ("doesn't load").

Route the deny path through a named location that does a real
`return 302 /<panel>/`, so the client gets a proper Location and
lands on the panel login. The authorized path (auth_request 200 →
@diag_sso_ok → 302 + diag cookie) is unchanged.

Verified with nginx + a TLS mock panel: unauthenticated hit now
redirects to the panel login; logged-in hit (browser-like cookie
handling) resolves to the diag page in 1-2 redirects, no loop.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

x-ui-latest.sh

@@ -505,9 +505,14 @@ server {
     # skip it (rewrite phase), hence the try_files → named-location hop.
     location = /${panel_path}/diag {
         auth_request /__diag_auth;
-        error_page 401 403 =302 /${panel_path}/;
+        # Named location (not "=302 /uri") so the deny path emits a real Location
+        # header; an internal-redirect error_page returns a 302 with no Location.
+        error_page 401 403 = @diag_login;
         try_files /__nonexistent @diag_sso_ok;
     }
+    location @diag_login {
+        return 302 /${panel_path}/;
+    }
     location @diag_sso_ok {
         add_header Set-Cookie "diag_key=${diag_token}; Path=${diag_path}; Secure; HttpOnly; SameSite=Lax; Max-Age=604800";
         return 302 ${diag_path};

x-ui-patch.sh

@@ -373,9 +373,14 @@ server {
     # hence the try_files → named-location hop.
     location = /${panel_path}/diag {
         auth_request /__diag_auth;
-        error_page 401 403 =302 /${panel_path}/;
+        # Named location (not "=302 /uri") so the deny path emits a real Location
+        # header; an internal-redirect error_page returns a 302 with no Location.
+        error_page 401 403 = @diag_login;
         try_files /__nonexistent @diag_sso_ok;
     }
+    location @diag_login {
+        return 302 /${panel_path}/;
+    }
     location @diag_sso_ok {
         add_header Set-Cookie "diag_key=${diag_token}; Path=${diag_path}; Secure; HttpOnly; SameSite=Lax; Max-Age=604800";
         return 302 ${diag_path};