betterbird: ship the operator's approved configuration, and show and fix drift from it (hq issue 345)

A module that installs Betterbird but leaves every node to its own settings does not set Betterbird up.
The operator approved the configuration on 2026-10-12, and it now ships in three layers. The policy
locks what must never differ: telemetry, add-on updates, the vendor's notices and the start page. A
defaults file carries the laptop's setup, so a fresh node gets it untouched. The setting prefs stays a
node's exceptions.

A default loses to a value the profile saved. betterbird_config shows that drift, betterbird_check
reports it, and betterbird_config_apply clears it while Betterbird is quit. keep proposes a node layer
instead of writing user.js. betterbird_prefs now reads Betterbird's real defaults from omni.ja, and
withholds of mailnews.* only what names an account. The default-client ask is decided from its own
policy entry, not from the first thing the policy lacks.

modules/betterbird/module.json

@@ -21,6 +21,8 @@
   "tools": [
     "betterbird_status",
     "betterbird_prefs",
+    "betterbird_config",
+    "betterbird_config_apply",
     "betterbird_user_js",
     "betterbird_log",
     "betterbird_restart",