Add TLS requirement for HTTP hook destinations: - Warn when plain http:// URLs are used - Reject remote http:// in production mode - Allow http://localhost and http://127.0.0.1 for dev Prevents secret exfiltration over unencrypted channels.