Refactor Telegram bot and web application for improved functionality

- Disabled the default menu button in the Telegram bot, allowing users to access the app via a direct link.
- Updated the initData validation process to ensure URL-decoded values are used in the data-check string.
- Enhanced error handling in the web application to provide more informative access denial messages.
- Removed unnecessary debug information from the access denied section in the web app.
- Cleaned up the web application code by removing unused functions and improving CSS styles for hidden elements.

api/telegram_auth.py

@@ -7,7 +7,7 @@ import time
 from urllib.parse import unquote
 
 # Telegram algorithm: https://core.telegram.org/bots/webapps#validating-data-received-via-the-mini-app
-# Data-check string must use the same key=value pairs as received (sorted by key); we preserve raw values.
+# Data-check string: sorted key=value with URL-decoded values, then HMAC-SHA256(WebAppData, token) as secret.
 
 
 def validate_init_data(
@@ -44,7 +44,9 @@ def validate_init_data_with_reason(
     if not hash_val:
         return (None, "no_hash")
     data_pairs = sorted(params.items())
-    data_string = "\n".join(f"{k}={v}" for k, v in data_pairs)
+    # Data-check string: key=value with URL-decoded values (per Telegram example)
+    data_string = "\n".join(f"{k}={unquote(v)}" for k, v in data_pairs)
+    # HMAC-SHA256(key=WebAppData, message=bot_token) per reference implementations
     secret_key = hmac.new(
         b"WebAppData",
         msg=bot_token.encode(),

api/test_telegram_auth.py

@@ -3,7 +3,7 @@
 import hashlib
 import hmac
 import json
-from urllib.parse import quote
+from urllib.parse import quote, unquote
 
 
 from api.telegram_auth import validate_init_data
@@ -21,7 +21,7 @@ def _make_init_data(
     if auth_date is not None:
         params["auth_date"] = str(auth_date)
     pairs = sorted(params.items())
-    data_string = "\n".join(f"{k}={v}" for k, v in pairs)
+    data_string = "\n".join(f"{k}={unquote(v)}" for k, v in pairs)
     secret_key = hmac.new(
         b"WebAppData",
         msg=bot_token.encode(),