Use Telegram Login Widget for web auth

lib/api/mapflow_api.dart

@@ -3,32 +3,65 @@ import 'dart:convert';
 import 'package:http/http.dart' as http;
 import 'package:latlong2/latlong.dart';
 
-import '../auth/telegram_init_data.dart' as telegram_auth;
+import '../auth/telegram_session.dart' as telegram_auth;
 import '../models/place_models.dart';
 
 class MapflowApi {
   MapflowApi({
     http.Client? client,
     String? telegramInitData,
+    String? telegramLoginData,
     String endpoint = const String.fromEnvironment(
       'API_BASE_URL',
       defaultValue: '/graphql',
     ),
   }) : _client = client ?? http.Client(),
        _telegramInitData = telegramInitData ?? telegram_auth.telegramInitData(),
+       _telegramLoginData =
+           telegramLoginData ?? telegram_auth.telegramLoginData(),
        _endpoint = Uri.base.resolve(endpoint);
 
   final http.Client _client;
   final String _telegramInitData;
+  final String _telegramLoginData;
   final Uri _endpoint;
 
-  bool get hasTelegramAuth => _telegramInitData.isNotEmpty;
+  bool get hasTelegramAuth =>
+      _telegramInitData.isNotEmpty || _telegramLoginData.isNotEmpty;
 
   Future<AppUser?> authenticateTelegram() async {
-    if (_telegramInitData.isEmpty) {
+    if (!hasTelegramAuth) {
       return null;
     }
 
+    if (_telegramLoginData.isNotEmpty) {
+      final loginData = jsonDecode(_telegramLoginData) as Map<String, dynamic>;
+      final data = await _graphql(
+        '''
+          mutation AuthenticateTelegramLogin(
+            \$input: AuthenticateTelegramLoginInput!
+          ) {
+            authenticateTelegramLogin(input: \$input) {
+              user {
+                id
+                telegramId
+                username
+                firstName
+                lastName
+                photoUrl
+                languageCode
+              }
+            }
+          }
+        ''',
+        variables: {'input': loginData},
+      );
+
+      final payload = data['authenticateTelegramLogin'] as Map<String, dynamic>;
+      final user = payload['user'] as Map<String, dynamic>;
+      return AppUser.fromJson(user);
+    }
+
     final data = await _graphql(
       '''
         mutation AuthenticateTelegram(\$input: AuthenticateTelegramInput!) {
@@ -98,7 +131,7 @@ class MapflowApi {
     required int durationSeconds,
     required String audioObjectKey,
   }) async {
-    if (_telegramInitData.isEmpty) {
+    if (!hasTelegramAuth) {
       throw StateError('Telegram authorization is required.');
     }
 
@@ -133,6 +166,8 @@ class MapflowApi {
         'content-type': 'application/json',
         if (_telegramInitData.isNotEmpty)
           'x-telegram-init-data': _telegramInitData,
+        if (_telegramLoginData.isNotEmpty)
+          'x-telegram-login-data': _telegramLoginData,
       },
       body: jsonEncode({'query': query, 'variables': variables ?? {}}),
     );