Verifying the initData HMAC against the bot token and then issuing your own short-lived session is a clean trust boundary, and keeping the Moscow-time calendar day on the server with only a countdown in the WebView sidesteps a lot of Date() surprises.
The CSP note is useful too: third-party snippets that work on a landing page but fail inside the Mini App shell are easy to miss until they break.
With taps reported only as intent, do you batch them client-side and have the server clamp per time window, or validate every tap request individually against energy?