tailscale-proxy: switch Telegram proxy to Telemt; rework Grafana dashboard

alexbers/mtprotoproxy's Fake-TLS handshake was rejected by real Telegram
clients (server/clock/secret/egress all verified good), so replace it with
Telemt (ghcr.io/telemt/telemt:3.4.25) - the same proven implementation as the
Hetzner endpoint. Config: Fake-TLS on :1080, use_middle_proxy=false (direct-to-DC,
required with a SOCKS5 upstream) and [[upstreams]] socks5 ts-proxy:1055 so only
DC-bound traffic exits via the Tailscale exit node. Secret in host-only
telemt.toml; config.py.example (alexbers) removed. Telemt stays on json-file
(its tracing logs don't ship cleanly via the syslog driver).

Dashboard: retarget the working 3proxy queries from :1080 to the HTTP front
:3128 (the old HTTP section used stale tinyproxy patterns), drop the retired
SOCKS5 section, add a Telegram/Telemt info panel.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tailscale-proxy/telemt/telemt.toml.example

@@ -0,0 +1,38 @@
+# Telemt config for the tekhnohim Telegram Fake-TLS MTProto proxy (docker host).
+#
+# The REAL telemt.toml is host-only at
+# /mnt/containers/tailscale-proxy/telemt/telemt.toml (mode 0600, owned by the
+# image's nonroot uid 65532, NOT in git) because [access.users] holds the
+# proxy secret. This is the secret-free template.
+#
+# Egress: [[upstreams]] socks5 -> ts-proxy:1055 (Tailscale userspace SOCKS5),
+# so ONLY Telegram-DC traffic exits via the Hetzner exit node (89.167.72.79).
+# The client-facing side is direct Fake-TLS on :1080.
+
+# Direct-to-DC mode: with a SOCKS5 upstream, only DC-bound traffic is chained,
+# so use_middle_proxy MUST be false (middle-proxy/ME servers are not routed
+# through the upstream and fail to init behind the Tailscale SOCKS5).
+[general]
+use_middle_proxy = false
+
+[general.modes]
+classic = false
+secure = false
+tls = true                       # ee / FakeTLS
+
+[server]
+port = 1080
+
+[censorship]
+tls_domain = "www.google.com"    # SNI presented in the Fake-TLS handshake; tunable
+
+[access.users]
+# username = 32-hex-char secret (16 bytes). Generate: openssl rand -hex 16
+tekhnohim = "00000000000000000000000000000000"
+
+# Chain Telegram-DC connections out through the Tailscale userspace SOCKS5.
+[[upstreams]]
+type = "socks5"
+address = "ts-proxy:1055"
+weight = 1
+enabled = true