chore: add coverage reporting and improve documentation

- Added `pytest-cov` as a development dependency for coverage reporting.
- Configured pytest to include coverage options, ensuring code coverage is reported and enforced.
- Updated the README to include contributing guidelines and logging policies, enhancing clarity for developers.
- Added a new section in the configuration documentation emphasizing the necessity of serving the application over HTTPS in production for security purposes.
- Introduced a new `.coverage` file to track test coverage metrics.

duty_teller/api/dependencies.py

@@ -105,10 +105,22 @@ def require_miniapp_username(
 
 
 def _is_private_client(client_host: str | None) -> bool:
+    """Return True if client_host is localhost or RFC 1918 private IPv4.
+
+    Used to allow /api/duties without initData when opened from local/private
+    network (e.g. dev). IPv4 only; IPv6 only 127/::1 checked.
+
+    Args:
+        client_host: Client IP or hostname from request.
+
+    Returns:
+        True if loopback or 10.x, 172.16–31.x, 192.168.x.x.
+    """
     if not client_host:
         return False
     if client_host in ("127.0.0.1", "::1"):
         return True
+    # RFC 1918 private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
     parts = client_host.split(".")
     if len(parts) == 4:
         try: