Telegram Mini App v1: initData auth bridge into the existing site

- POST /api/public/tg-webapp-auth: HMAC-verifies WebApp initData against the
  companion bot token (12h freshness, timing-safe), maps chat -> member via
  tg-links.json, mints a message session -> linked members land on /my/<id>
  with zero login
- /app entry page (vendored telegram-web-app.js keeps CSP script-src 'self');
  unlinked users get the one-time wallet-link instructions
- tg-app.js on all pages: no-op in browsers; inside the webview lazy-loads the
  SDK, expands, themes header/background #071421, wires native BackButton
- Bot menu button set programmatically to open /app; /start + help mention it
- Synced chat.js canned answer + AI system prompt (Mini App facts)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

public/tools.html

@@ -372,4 +372,4 @@ Watch the short training, look at the live payment feed, then ask me anything.
 </div></section>
 </main>
 <footer class="wrap disclaimer">Independent RM Circle Team Build team resource. Informational only — not an earnings guarantee or investment advice. Cryptocurrency participation carries risk of loss.<div class="footer-links"><a href="/">Strategy</a><a href="/training">Training</a><a href="/start">Getting Started</a><a href="/how-pay-works">How You Get Paid</a><a href="/disclaimer">Disclaimers</a></div></footer>
-<script src="/tools.js"></script><script src="/translate.js" defer></script></body></html>
+<script src="/tools.js"></script><script src="/translate.js" defer></script><script src="/tg-app.js" defer></script></body></html>