Use `hmac.compare_digest` in `check_telegram_authorization`

[YaronZaki]

• Difficulty: good-first-issue · Effort: XS · Impact: Telegram bot auth

• Problem Statement
  quantara/web_app/telegram/utils.py:

  if hash_value != check_hash:
      return False

  String equality != short-circuits on first byte mismatch. A timing
  attacker who can observe the auth endpoint signing latency can in
  principle recover a valid hash byte-by-byte.

• Expected Outcome
  Replace with hmac.compare_digest(hash_value, check_hash).

• Acceptance Criteria

  • Existing tests pass.
  • Micro-benchmark: 100k iterations of full-vs-prefix mismatch shows all within 0.001ms.

• Implementation Notes
  One-line. Both arguments must be str for compare_digest; cast if needed.

• Files / Modules Affected

  • quantara/web_app/telegram/utils.py
  • quantara/web_app/tests/test_telegram.py

• Dependencies: standalone.

[GBOYEE]

Hey! check_telegram_authorization compares hashes with !=, which short-circuits and is timing-observable. I'd swap to hmac.compare_digest in quantara/web_app/telegram/utils.py — a one-line, safe change. I can do it right away — may I take it?

[kevinnft]

Opened PR fixing constant-time Telegram auth hash comparison:

#355

Uses hmac.compare_digest and fails closed on unequal-length inputs.