feat(security): enforce HTTPS for public/browser-facing URLs in production

[Copilot]

SonarCloud S5332 flagged HTTP URLs across several API client files. After classification, all flagged defaults (http://core-api:5000, http://billing-service:8000, etc.) are server-only Docker-network URLs — safe as HTTP. The two genuinely browser-facing variables (NEXT_PUBLIC_API_URL, PUBLIC_APP_URL) had no production HTTPS enforcement.

Classification

URL	Verdict
http://core-api:5000, http://*-service:8000	Server-only Docker URLs — not browser-reachable
http://app-frontend:3000 (marketing-site internalAppUrl)	Server-only Docker URL
http://127.0.0.1:41017 (billing.ts)	Localhost, E2E-only (PLAYWRIGHT_E2E=1 guard)
NEXT_PUBLIC_API_URL, PUBLIC_APP_URL	Browser-facing — remediated

Changes

• src/lib/url-validation.ts (both apps) — requireHttpsInProduction(name, value) helper: throws in production if the value starts with http://, no-ops in dev/test.

export function requireHttpsInProduction(name: string, value: string): string {
  if (process.env.NODE_ENV === 'production' && value.startsWith('http://')) {
    throw new Error(`${name} must use HTTPS in production. ...`);
  }
  return value;
}

• apps/app-frontend/next.config.ts — calls requireHttpsInProduction('NEXT_PUBLIC_API_URL', ...) at startup inside the existing production env-var validation block (fail-closed before the server accepts traffic).

• apps/marketing-site/src/config.ts — wraps appUrl with the helper; internalAppUrl is intentionally left unvalidated (Docker-internal only). The marketing-site variant also checks import.meta.env.PROD because Astro sets that flag during SSG builds before NODE_ENV propagates.

• 18 unit tests (9 per app) covering: throws on http:// in production, passes on https:// in production, passes on http://localhost in dev/test.