docs: update environment configuration and API documentation

- Revised the `.env.example` file to clarify the purpose of the `MINI_APP_SKIP_AUTH` variable, emphasizing its insecure nature and restriction to development use only.
- Updated the `README.md` to reflect changes in API authentication requirements, specifying that unauthenticated access to `/api/duties` and `/api/calendar-events` is only allowed with `MINI_APP_SKIP_AUTH=1`.
- Enhanced `configuration.md` to detail the implications of using `MINI_APP_SKIP_AUTH` for API access without Telegram initData.
- Removed the `_is_private_client` function and its associated tests, streamlining the codebase and focusing on the current authentication model.
- Added logging in `run.py` to warn when `MINI_APP_SKIP_AUTH` is enabled, highlighting the security risks.

tests/test_app.py

@@ -37,10 +37,9 @@ def test_duties_from_after_to(client):
     assert "from" in detail or "to" in detail or "after" in detail or "позже" in detail
 
 
-@patch("duty_teller.api.dependencies._is_private_client")
 @patch("duty_teller.api.dependencies.config.MINI_APP_SKIP_AUTH", False)
-def test_duties_403_without_init_data_from_public_client(mock_private, client):
-    mock_private.return_value = False
+def test_duties_403_without_init_data(client):
+    """Without X-Telegram-Init-Data and without MINI_APP_SKIP_AUTH → 403 (any client)."""
     r = client.get(
         "/api/duties",
         params={"from": "2025-01-01", "to": "2025-01-31"},
@@ -390,6 +389,16 @@ def test_calendar_ical_events_all_returns_all_event_types(
 # --- /api/calendar-events ---
 
 
+@patch("duty_teller.api.dependencies.config.MINI_APP_SKIP_AUTH", False)
+def test_calendar_events_403_without_init_data(client):
+    """Without X-Telegram-Init-Data and without MINI_APP_SKIP_AUTH → 403."""
+    r = client.get(
+        "/api/calendar-events",
+        params={"from": "2025-01-01", "to": "2025-01-31"},
+    )
+    assert r.status_code == 403
+
+
 @patch("duty_teller.api.app.config.EXTERNAL_CALENDAR_ICS_URL", "")
 @patch("duty_teller.api.app.config.MINI_APP_SKIP_AUTH", True)
 def test_calendar_events_empty_url_returns_empty_list(client):