Remove vendored third-party files from apps/jaahd/vendor

Operator decision in task 11079: no third-party vendor files are committed or distributed in the repo — "All third party should be installed via requirements.txt or poetry or whatever. No actual files from third party vendors should be distributed. That applies to main code as well." Chosen mechanism for the node daemon: "Not in repo; .deb postinst venv". Today apps/jaahd/vendor/ commits websockets, PyYAML (load half), cryptography (pure part + _rust.abi3.so per CPU, ~14 MB each, not stripped) and cffi's _cffi_backend per CPython 3.12/3.13/3.14 × x86_64/aarch64 (~31 MB), loaded through vendor_path.ensure_vendor_on_path / ensure_native_on_path. They also ship in the community-edition tree. Requirements: 1. Delete apps/jaahd/vendor/ and the vendor_path loader; the daemon imports websockets, yaml and cryptography from a venv. 2. Add a hash-pinned requirements file (single home for the pins; infra/jaah/requirements.txt already pins websockets) for the daemon's runtime deps. 3. The .deb postinst builds /usr/lib/jaahd/venv with `python3 -m venv` and `pip install --require-hashes --only-binary=:all:` from that file; upgrade rebuilds it when the pins change; systemd units and every jaahd entry point run the venv's python. 4. Node bootstrap / MicroVM guests / CE Dockerfile.node / build_jaahd_bundle follow the same path; nodes need PyPI reach at install/upgrade (document it and the failure sentence when unreachable). 5. Update apps/jaahd/vendor/README.md's facts into the new home (delete the README), CE manifest.toml entries and sensitive allowlists that name vendor/. Out of scope: agent bundles (done in 11079), the console's npm deps, the runner CLI installer. Done means: - `git ls-files apps/jaahd/vendor` is empty and no tracked .so remains under apps/. - A fresh `.deb` installed on a clean Ubuntu 24.04 node starts jaahd, connects to the CP (websockets) and opens a NodeVault credential (cryptography). - `./dc check quick` green; the CE tree build/check green.