Prune orphaned headscale/Bedrock settings pages and Telegram

Epic ask (#11132, item 2): "The mirror build should prune the `aws/`, Slack, Telegram and headscale code it does not need." The API side is pruned; the console still ships dead cloud-only code in the CE tree. ## Reproduction (finish runner, develop @ 2048639171) `python3 tools/community_edition/build_tree.py <out>` then in `<out>`: - `apps/web/src/pages/settings/headscaleAllowlist/` (HeadscaleAllowlistSection.tsx, api.ts, test) ships. Its only importer, `apps/web/src/pages/settingsCloud.tsx:15`, is excluded from CE (`tools/community_edition/manifest.toml:90`) — an orphan that names the headscale allowlist API. - `apps/web/src/pages/settings/bedrock/` (BedrockStatusSection.tsx, api.ts, test) ships; only importer `settingsCloud.tsx:7` — orphan; `apps/api/app/bedrock/**` is already cut under `[feature.jaah_ai_credit]` (`packages/editions/features.toml:346-353`). - `apps/web/src/components/TelegramConnect.tsx` and `apps/web/src/lib/telegramBot.ts` ship and are statically imported by `apps/web/src/pages/ProfilePage.tsx:25` (and `settings/KnobSection.tsx`, `NotificationsPanel.tsx`/`LinkCodeDialog.tsx`/`hooks/useLinkCodeFlow.ts` reference them), though every `/api/.../telegram*` route is gone from CE (`[feature.telegram]`, features.toml:524). - `check_tree.py`'s orphan check is Python-only (`tools/community_edition/check_tree.py:16,272`), so these pass unnoticed. ## Fix (no new mechanism) - `packages/editions/features.toml`: `[feature.tailnet]` paths += `apps/web/src/pages/settings/headscaleAllowlist/**`; `[feature.jaah_ai_credit]` paths += `apps/web/src/pages/settings/bedrock/**`; `[feature.telegram]` paths += `apps/web/src/components/TelegramConnect.tsx`, `apps/web/src/components/TelegramConnect.test.tsx`, `apps/web/src/lib/telegramBot.ts` (only if every remaining importer is moved off it). - `ProfilePage.tsx`: load TelegramConnect exactly as SlackConnect already is (`ProfilePage.tsx:78-83`, `isEnabled('telegram') ? import.meta.glob(...) : {}`); without it the Telegram row offers no Connect. Move any shared constant `KnobSection.tsx` needs from `telegramBot.ts` into a shared lib, or hide that knob row behind `isEnabled('telegram')`, per the pattern PR #7290 used. - Add a `tools/tests/test_community_edition.py` case asserting these paths are absent from the built tree. ## Acceptance - AC1: built CE tree has no `headscaleAllowlist`, `settings/bedrock`, `TelegramConnect`, `telegramBot` file — oracle: `find <tree>/apps/web -iname '*headscale*' -o -iname '*bedrock*' -o -iname '*telegram*'` prints nothing; new pytest case green. - AC2: CE console builds in the tree (`npm ci && npm run build` in `<tree>/apps/web`, as the `mirrors.yml` ce-tree job does) and `check_tree.py` reports no new finding. - AC3: cloud unchanged — Profile → Telegram Connect and Settings → headscale allowlist / Bedrock status still render on cloud (apps/web unit tests for those components green; browser check on dev where reachable). Out of scope: `apps/jaahd/bedrock_*.py` (node runner auth, wired through the daemon); extending the orphan check to TypeScript; any cloud-edition behaviour; the 7 `[tracking]` findings (infra/jaah/pkgmgr.py, ui-style-guide.md) owned by task 11169. Done means: - AC1 oracle output empty and the new test passes. - `./dc check quick` green; merge lane `./dc check full` green (incl. Mirror trees (strict) and Community edition tooling suite). - The PR's Jaah Deploy succeeds (or is superseded).

CE tree no longer ships the console's headscale/Bedrock/Telegram UI; telegramBot.ts folded into KnobSection; Profile loads Telegram behind isEnabled. #7303 merged (lane full gate green). Dev deploy red from 11131's migration (owned by draft 11175), not this diff. Memory: none applied.