fix(tg): show Open-from-Telegram wall for empty initData in production

Opening /tg in a plain browser loads telegram.org's script, which
defines window.Telegram.WebApp with EMPTY initData (no real launch
behind it). Production posted that empty string to webapp-auth → 422 →
"Couldn't sign in". The dev path already guarded this (cb55f2b9); the
prod path didn't. Now a bridge with no initData that isn't the dev mock
shows the "Open from Telegram" wall instead of erroring — the cockpit is
a phone-from-Telegram surface, and a desktop browser gets the wall, not
a failed auth.

panel/src/app/(tg)/tg/__tests__/page.test.tsx

@@ -83,6 +83,20 @@ describe("TelegramMiniAppPage — auth bootstrap", () => {
     expect(post).not.toHaveBeenCalled();
   });
 
+  it("shows the Open-from-Telegram wall in production when the CDN bridge has empty initData", async () => {
+    // A plain browser at /tg: the telegram.org script defines WebApp but
+    // with no initData. Production must not post the empty payload (422) —
+    // it shows the wall, same as no bridge at all.
+    waitForTelegramWebApp.mockResolvedValue(mockWebApp(""));
+
+    render(<TelegramMiniAppPage />);
+
+    await waitFor(() =>
+      expect(screen.getByText(/open from telegram/i)).toBeInTheDocument(),
+    );
+    expect(post).not.toHaveBeenCalled();
+  });
+
   it("calls ready/expand, posts initData, and renders the cockpit on success", async () => {
     const webApp = mockWebApp("real-init-data");
     waitForTelegramWebApp.mockResolvedValue(webApp);