Allow a plain HTTP public URL with an explicit opt-in

[velrith]

Refs #398.

OAC_PUBLIC_URL_INSECURE=1 accepts an http:// origin on a host that is not loopback, for a deployment that stays on a network the operator controls and has no certificate authority to satisfy.

The opt-in mirrors core.runtime_history.insecure:

• default off, so ValidateCoreURL and every existing caller behave exactly as before;
• refused for an https:// origin;
• refused without OAC_PUBLIC_URL;
• any value other than 0 or 1 stops Core at startup.

With it on, Core accepts the origin and reports local_only: false for it, so Web stops showing the configure-HTTPS notice. Core also reports insecure_public_url, which carries the same decision to the node path: Web passes --allow-insecure-core-url to the generated node command only for that installation, the installer records it in the node's provider.json, and the node, the installer and its artifact downloads then accept the plain origin.

Scope

Core:

• services/core/internal/deployment/public_url.go: ValidateCoreURLInsecure adds the non-loopback HTTP case; ValidateCoreURL is unchanged.
• services/core/cmd/server/process_configuration.go: reads the flag and applies it to OAC_PUBLIC_URL.
• services/core/internal/api/installation.go, services/core/cmd/server/installation.go: report insecure_public_url.
• services/core/internal/sandbox/node and services/core/cmd/sandbox-node: enrollment, identity and connection accept the plain origin when the deployment carries the opt-in.

Node enrollment and installer:

• services/core/internal/sandbox/providers/config.go: the node's provider.json gains insecure_core_url.
• deploy/install/node_install.py: adds --allow-insecure-core-url, records the choice in provider.json, and refuses the flag when the configured origin is https or absent.
• deploy/install/node_generations.py: a later generation inherits the recorded choice.
• deploy/install/distribution.py: artifact URLs and redirects admit the plain origin only with the opt-in; host allowlists and SHA-256 checks are unchanged.

Web:

• packages/agents-client/src/admin-types.ts, admin-projection.ts: project insecure_public_url from the installation.
• apps/web/src/features/sandbox/core-origin.ts, enrollment-command.ts: issue a node command for the opted-in origin and add the flag.
• apps/web/src/lib/connection.ts: isValidDirectCoreBaseUrl takes the allowance as an argument instead of assuming loopback-only.

Documentation and contracts: configuration.md, nodes.md, install-options.md, console-api-usage.md in both languages, plus core.openapi.yaml and admin-api.md.

Deliberately unchanged, so the option cannot be reached by accident:

• install.sh, oac apply and web.core_url keep the HTTPS-or-loopback rule. The flag is a process variable, not a config.json key, and oac apply regenerates generated/core.env, so an installer-managed installation cannot keep it.
• Without the flag a remote plain-HTTP origin stays refused in Core, in the node and in the installer, an https:// origin never takes it, and the installer refuses the flag when no configured origin needs it, so a stale command fails instead of widening the policy.

Validation

• go build ./services/core/..., gofmt -l, go test ./services/core/... -count=1
• PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s deploy/install (268 tests, 1 skipped)
• pnpm --filter @oac/agents-client test and pnpm --filter @oac/web test, including typecheck
• make check-core and make check-core-store against a fresh PostgreSQL test database (the parallel make check-core package run collides on one database; the same packages pass serially with -p 1, and the store shard passes on its own)
• python3 scripts/config-reference.py --check, check-docs
• End to end on a second host: a microsandbox node installed, downloaded the Runtime image and registered over a plain-HTTP origin, and Core reports it provider_ready at the opted-in generation. Without the flag, Core refuses that origin at startup and the installer refuses the flag.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[RyanLee-Dev]

Thanks for the contribution, @velrith, and for the careful opt-in design.

We've since reworked how installations handle their address in #402. Core no longer manages a domain or certificates. Web is the single published entry, and HTTPS is terminated by the operator's reverse proxy or hosting platform (HTTPS and the reverse proxy). With that split, OAC_PUBLIC_URL is the HTTPS origin that proxy serves, and plain http:// stays limited to loopback, so we're not adding an insecure opt-in.

Closing this one. Thanks again!