Add HTTP/1.1-forced variant to network diagnostics to isolate PMTU/fragmentation hypothesis

api/src/handlers/admin.rs

@@ -766,8 +766,8 @@ pub async fn network_diagnostics() -> axum::Json<serde_json::Value> {
             }
         }
 
-        // Stage 3: full HTTPS round trip via reqwest, IP pinned to the resolved address
-        // — includes TLS handshake + request send + response — isolates TLS/app-layer stall
+        // Stage 3: full HTTPS round trip via reqwest (default, HTTP/2-eligible), IP pinned
+        // to the resolved address — includes TLS handshake + request send + response.
         let t2 = Instant::now();
         match reqwest::Client::builder()
             .resolve(host, addr)
@@ -792,6 +792,34 @@ pub async fn network_diagnostics() -> axum::Json<serde_json::Value> {
                 results.insert("https_client_build_error".into(), serde_json::json!(e.to_string()));
             }
         }
+
+        // Stage 3b: same request, but forced to HTTP/1.1 only — isolates whether a
+        // PMTU/fragmentation blackhole on larger HTTP/2 handshake/frame packets is the cause.
+        let t2b = Instant::now();
+        match reqwest::Client::builder()
+            .resolve(host, addr)
+            .timeout(std::time::Duration::from_secs(12))
+            .http1_only()
+            .build()
+        {
+            Ok(client) => {
+                let resp = client.get(format!("https://{host}/health")).send().await;
+                let full_ms = t2b.elapsed().as_millis();
+                match resp {
+                    Ok(r) => {
+                        results.insert("https_h1_full_ms".into(), serde_json::json!(full_ms));
+                        results.insert("https_h1_status".into(), serde_json::json!(r.status().as_u16()));
+                    }
+                    Err(e) => {
+                        results.insert("https_h1_full_ms".into(), serde_json::json!(full_ms));
+                        results.insert("https_h1_error".into(), serde_json::json!(e.to_string()));
+                    }
+                }
+            }
+            Err(e) => {
+                results.insert("https_h1_client_build_error".into(), serde_json::json!(e.to_string()));
+            }
+        }
     }
 
     // Stage 4: raw IPv6 connect test against a known-good public IPv6 address (Cloudflare 1.1.1.1),