Allow explicit per-provider HTTP auction endpoints #1521

Extract the existing demo's provider-local allow_insecure_http configuration as an independently reviewable unit. HTTPS remains the default; an explicit exception applies only to that provider and does not relax URL credentials, fragments or scheme validation.

Use the completed scoped design reviews and affected configuration/adapter regressions. This does not authorize production plaintext traffic, a new transport, network policy or deployment. Related original integration: #1424.