tailscale-proxy: replace TSPU-blocked SOCKS5 with Fake-TLS MTProto (Telegram)

Retire the generic SOCKS5 :1080 (raw SOCKS5 is blocked by TSPU/DPI for the
external Telegram use case) and add ts-lan-mtproto (alexbers/mtprotoproxy) on
:1080 instead: a Fake-TLS MTProto proxy whose Telegram-DC connections chain
through the Tailscale userspace SOCKS5 (SOCKS5_HOST=ts-proxy:1055), so egress
still rides the Hetzner exit node. Client-facing hop is domestic Fake-TLS to
test the hypothesis that TSPU bites hardest at the border. 3proxy keeps only
the HTTP front (:3128). The proxy secret lives in a host-only config.py
(0600, uid 10000, not in git); config.py.example is the secret-free template.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tailscale-proxy/3proxy.cfg

@@ -1,9 +1,13 @@
-# Unified LAN proxy for the tekhnohim Tailscale exit-node egress.
+# HTTP proxy for the tekhnohim Tailscale exit-node egress.
 #
-# One 3proxy instance serves BOTH an HTTP proxy (:3128) and a SOCKS5 proxy
-# (:1080), each chained to the Tailscale userspace SOCKS5 (ts-proxy:1055) so
-# clients exit the internet as the Hetzner exit-node IP (89.167.72.79).
-# TCP only (Tailscale userspace SOCKS5 has no UDP ASSOCIATE -> no QUIC/HTTP3).
+# This 3proxy instance serves an HTTP proxy (:3128) chained to the Tailscale
+# userspace SOCKS5 (ts-proxy:1055) so clients exit the internet as the Hetzner
+# exit-node IP (89.167.72.79). TCP only (no QUIC/HTTP3).
+#
+# The generic SOCKS5 (:1080) was RETIRED 2026-07-24: raw SOCKS5 is blocked by
+# TSPU/DPI for the external Telegram use case. Telegram is now served by the
+# `ts-lan-mtproto` container (Fake-TLS MTProto proxy) instead, which reuses the
+# :1080 external forward. See the profile / mtproto diagnostic.
 #
 # Access model (LAN free, outside password):
 #   * LAN 192.168.0.0/22  -> authorised by source IP, NO password.
@@ -44,4 +48,3 @@ parent 1000 socks5 ts-proxy 1055
 deny *
 
 proxy -p3128 -a -i0.0.0.0
-socks -p1080 -i0.0.0.0