docs/API.md and docs/openapi.yaml still described every cart/orders/
checkout/me route as requiring @require_telegram_auth with a possible 401
- no longer accurate now that those routes use @require_customer_auth
(falls back to a cookie-bound guest instead of rejecting the request, see
the guest-ordering feature). Documents the new decorator, the guest
identity scheme (GuestIdSequence/allocate_guest_telegram_id), the new
unauthenticated GET /checkout/track/<token> endpoint, and the checkout
response's new card_unavailable_message/track_url fields. Also adds the
previously-undocumented /me/locale path to openapi.yaml and updates
README's architecture notes accordingly.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Documents every route in bober_bbq/api/* (menu, settings, cart, orders,
checkout, payments) sourced by reading each handler and its downstream
model/service/util calls in full: auth via require_telegram_auth and the
Telegram initData HMAC validation (including the debug-only dev_user_id
bypass), exact request/response shapes, and every distinct error status
and body. Adds docs/API.md as the primary narrative reference and
docs/openapi.yaml as a machine-readable OpenAPI 3.0 spec covering the
same surface.
