Settings: put a knob's save refusal next

Seen while rendering Settings › Integrations › Telegram with a refused bot token (Task 7237). 1. A save refusal that names one knob (e.g. Telegram's "refused the bot token … The bot was not saved") renders only in the page-level alert above the search box; at 400px it sits a full screen above the Bot knob it is about. Also show it on the knob's row (or scroll to it) so the operator sees which control failed. 2. After a refused Bot save the refused bot stays picked with "1 unsaved"; Discard is the only way back. Say on the row that the saved bot is unchanged (or revert the picker to the saved value) so the page does not look half-saved. 3. The Integrations area also shows unrelated page-level alerts (Legal "Changed after Last updated…", "IP allowlist isn't on your plan") above every category; show each only in its own category so a Telegram refusal is not buried among them. Out of scope: the Telegram refusal copy and its `telegram_token_refused` code (Task 7237), delivery behaviour, plan gating. Done means: - Each item shipped, or rejected with a reason in the PR body. - `./dc check full` green.

Refused knob save now shows its reason and "Still saved: …" on the knob's row, and Settings opens the row. Edits that landed stop reading unsaved. Item 3 rejected (not reproducible). PR #5998 queued in merge lane; quick gate green; lane runs the full gate (local full runs cut short by host load). Visual check done.