tailscale-proxy: switch Telegram proxy to Telemt; rework Grafana dashboard

alexbers/mtprotoproxy's Fake-TLS handshake was rejected by real Telegram
clients (server/clock/secret/egress all verified good), so replace it with
Telemt (ghcr.io/telemt/telemt:3.4.25) - the same proven implementation as the
Hetzner endpoint. Config: Fake-TLS on :1080, use_middle_proxy=false (direct-to-DC,
required with a SOCKS5 upstream) and [[upstreams]] socks5 ts-proxy:1055 so only
DC-bound traffic exits via the Tailscale exit node. Secret in host-only
telemt.toml; config.py.example (alexbers) removed. Telemt stays on json-file
(its tracing logs don't ship cleanly via the syslog driver).

Dashboard: retarget the working 3proxy queries from :1080 to the HTTP front
:3128 (the old HTTP section used stale tinyproxy patterns), drop the retired
SOCKS5 section, add a Telegram/Telemt info panel.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tailscale-proxy/docker-compose.yaml

@@ -36,21 +36,27 @@ services:
         tag: tailscale-proxy
     networks: [proxynet]
 
-  # Telegram-only Fake-TLS MTProto proxy on :1080 (replaces the TSPU-blocked
-  # generic SOCKS5). Chains its Telegram-DC connections through the Tailscale
-  # userspace SOCKS5 (SOCKS5_HOST=ts-proxy:1055 in config.py) so egress still
-  # rides the Hetzner exit node. Client-facing hop is domestic Fake-TLS; the
-  # foreign leg is the WireGuard tunnel that already carries the HTTP proxy.
-  # config.py is host-only (0600, uid 10000, NOT in git) - holds the secret.
-  mtproto:
-    image: alexbers/mtprotoproxy:latest
-    container_name: ts-lan-mtproto
+  # Telegram Fake-TLS MTProto proxy on :1080. Uses Telemt (the same proven
+  # implementation as the Hetzner endpoint) after alexbers/mtprotoproxy's
+  # Fake-TLS handshake was rejected by real clients (see the mtproto diagnostic).
+  # Only DC-bound traffic is chained out through the Tailscale userspace SOCKS5
+  # ([[upstreams]] socks5 ts-proxy:1055 in telemt.toml), so egress rides the
+  # Hetzner exit node; the client-facing hop is direct Fake-TLS.
+  # telemt.toml is host-only (0600, uid 65532/nonroot, NOT in git) - holds the secret.
+  telemt:
+    image: ghcr.io/telemt/telemt:3.4.25
+    container_name: ts-lan-telemt
     restart: unless-stopped
     depends_on: [ts-proxy]
+    environment:
+      NO_COLOR: "1"                # cleaner `docker logs` (no ANSI escapes)
     volumes:
-      - "/mnt/containers/tailscale-proxy/mtproto/config.py:/home/tgproxy/config.py:ro,z"
+      - "/mnt/containers/tailscale-proxy/telemt/telemt.toml:/app/config.toml:ro,z"
     ports:
       - "192.168.0.35:1080:1080"
+    # Stays on json-file: telemt's tracing logs don't ship cleanly over the
+    # syslog driver, and `docker logs ts-lan-telemt` is worth keeping for this
+    # critical service. Observe it there (or wire its Prometheus metrics later).
     networks: [proxynet]
 
 networks: