HIPAA: warn on Telegram notifications like Slack

Telegram became a notification channel (Task 6738) and a listed subprocessor (Task 7091), but it is absent from `apps/api/app/hipaa.py` `SURFACES`, so a HIPAA org's admins get no non-BAA warning for it (the vendor register's Telegram row records this gap). Ask: add a `telegram` surface (vendor `telegram`) to `SURFACES`, show `NonBaaWarning surface="telegram"` beside Telegram Connect on Profile › Notifications as Slack does, and update the vendor register's BAA cell and BAA § 5 if it enumerates surfaces. Out of scope: blocking delivery; Telegram delivery behaviour. Done means: - A HIPAA org member sees the warning under Telegram Connect; a non-HIPAA org sees nothing. - Vendor register Telegram BAA cell reads "Not needed (no PHI)… warned" consistently with Slack's. - `./dc check full` green.

Added a telegram HIPAA surface; Telegram Connect shows the non-BAA warning like Slack's; vendor register BAA cell updated. PR #5795 merged (b6c410d45). Full gate: 2 API tests red that also fail on current develop (not this diff), filed as draft #7146. Visual check done: warning at 1440/375 for HIPAA, none otherwise. Deploy superseded.