Document WebUntis

docs/API.md gains the findings: the endpoint and its required version
parameter, the one-time code and the two error codes worth naming, the Z that
means local time, a substitution being two periods, the unused exam module
that puts announced tests in the period notes, and a day without lessons that
is not a holiday. Those cost an afternoon of probing to learn and nothing
upstream states them.

docs/AUTH.md sets the key against the Schulcloud token it sits beside: no
password, nothing to keep alive, revocable on its own, and not read-only in
itself — which is why the allowlist exists. PI.md and DEPLOYMENT.md add the
four values, the container recreate a changed key needs, and the clock
requirement; the Pi's troubleshooting table gains both failure messages.

README and CLAUDE.md say what the server now is: Schulcloud for the material,
WebUntis for the day. Smoke is 89 checks with the index and a key, 87
live-only, 9 fewer without one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

local-instance/README.md

@@ -217,11 +217,13 @@ be pointed at the instance in between:
 
 ```bash
 eval "$(./scripts/mcp-env.sh)"      # as the demo student
-cd .. && npm run smoke              # 79 checks against the local instance
+cd .. && npm run smoke              # 80 checks against the local instance
 ```
 
 `mcp-env.sh` points the index at its own database, `schulcloud_local`, and the
-mirror at `tmp/mirror-local` — not just the instance at this one. The root
+mirror at `tmp/mirror-local` — not just the instance at this one, and it switches
+WebUntis off, since this instance has no timetable and the key in the root `.env`
+is the real school's. The root
 `.env` normally targets the live account, and process env beats `--env-file`, so
 without that a local smoke run would crawl these fixtures into the live index,
 where a per-course refresh then carries them forward indefinitely. Create the