Refactor configuration and enhance Telegram initData validation

- Improved formatting and readability in config.py and other files by adding line breaks.
- Introduced INIT_DATA_MAX_AGE_SECONDS to enforce replay protection for Telegram initData.
- Updated validate_init_data function to include max_age_seconds parameter for validation.
- Enhanced API to reject old initData based on the new max_age_seconds setting.
- Added tests for auth_date expiry and validation of initData in test_telegram_auth.py.
- Updated README with details on the new INIT_DATA_MAX_AGE_SECONDS configuration.

api/test_app.py

@@ -1,10 +1,14 @@
 """Tests for FastAPI app /api/duties."""
+
+import time
 from unittest.mock import patch
 
 import pytest
 from fastapi.testclient import TestClient
 
+import config
 from api.app import app
+from api.test_telegram_auth import _make_init_data
 
 
 @pytest.fixture
@@ -101,3 +105,28 @@ def test_duties_200_with_allowed_user(mock_can_access, mock_validate, client):
     assert len(r.json()) == 1
     assert r.json()[0]["full_name"] == "Иван Иванов"
     mock_fetch.assert_called_once_with("2025-01-01", "2025-01-31")
+
+
+def test_duties_e2e_auth_real_validation(client, monkeypatch):
+    """E2E: valid initData + allowlist, no mocks on validate_init_data; full auth path."""
+    test_token = "123:ABC"
+    test_username = "e2euser"
+    monkeypatch.setattr(config, "BOT_TOKEN", test_token)
+    monkeypatch.setattr(config, "ALLOWED_USERNAMES", {test_username})
+    monkeypatch.setattr(config, "ADMIN_USERNAMES", set())
+    monkeypatch.setattr(config, "INIT_DATA_MAX_AGE_SECONDS", 0)
+    init_data = _make_init_data(
+        {"id": 1, "username": test_username},
+        test_token,
+        auth_date=int(time.time()),
+    )
+    with patch("api.app._fetch_duties_response") as mock_fetch:
+        mock_fetch.return_value = []
+        r = client.get(
+            "/api/duties",
+            params={"from": "2025-01-01", "to": "2025-01-31"},
+            headers={"X-Telegram-Init-Data": init_data},
+        )
+    assert r.status_code == 200
+    assert r.json() == []
+    mock_fetch.assert_called_once_with("2025-01-01", "2025-01-31")