chore: add coverage reporting and improve documentation

- Added `pytest-cov` as a development dependency for coverage reporting.
- Configured pytest to include coverage options, ensuring code coverage is reported and enforced.
- Updated the README to include contributing guidelines and logging policies, enhancing clarity for developers.
- Added a new section in the configuration documentation emphasizing the necessity of serving the application over HTTPS in production for security purposes.
- Introduced a new `.coverage` file to track test coverage metrics.

tests/test_app.py

@@ -250,11 +250,25 @@ def test_duties_200_with_unknown_event_type_mapped_to_duty(client):
     assert data[0]["full_name"] == "User A"
 
 
+def test_calendar_ical_404_invalid_token_format(client):
+    """GET /api/calendar/ical/{token}.ics with invalid token format returns 404 without DB call."""
+    # Token format must be base64url, 40–50 chars; short or invalid chars → 404
+    r = client.get("/api/calendar/ical/short.ics")
+    assert r.status_code == 404
+    assert "not found" in r.text.lower()
+    r2 = client.get("/api/calendar/ical/" + "x" * 60 + ".ics")
+    assert r2.status_code == 404
+    r3 = client.get("/api/calendar/ical/../../../etc/passwd.ics")
+    assert r3.status_code == 404
+
+
 @patch("duty_teller.api.app.get_user_by_calendar_token")
 def test_calendar_ical_404_unknown_token(mock_get_user, client):
     """GET /api/calendar/ical/{token}.ics with unknown token returns 404."""
     mock_get_user.return_value = None
-    r = client.get("/api/calendar/ical/unknown-token-xyz.ics")
+    # Use a token that passes format validation (base64url, 40–50 chars)
+    valid_format_token = "A" * 43
+    r = client.get(f"/api/calendar/ical/{valid_format_token}.ics")
     assert r.status_code == 404
     assert "not found" in r.text.lower()
     mock_get_user.assert_called_once()
@@ -282,8 +296,10 @@ def test_calendar_ical_200_returns_only_that_users_duties(
     mock_build_ics.return_value = (
         b"BEGIN:VCALENDAR\r\nVEVENT\r\n2026-06-15\r\nEND:VCALENDAR"
     )
+    # Token must pass format validation (base64url, 40–50 chars)
+    token = "x" * 43
 
-    r = client.get("/api/calendar/ical/valid-token.ics")
+    r = client.get(f"/api/calendar/ical/{token}.ics")
     assert r.status_code == 200
     assert r.headers.get("content-type", "").startswith("text/calendar")
     assert b"BEGIN:VCALENDAR" in r.content