Validate Telegram Mini App initData in PHP: HMAC-SHA-256, timing-safe compare, and auth_date expiry

Parse the initData query string, recompute the HMAC-SHA-256 hash with the bot token, compare it in constant time, and enforce an auth_date TTL.