Accept plain HTTP issuer URLs

[czpython]

What changes

• SecretIssuer accepts http:// and https:// issuer URLs. It still refuses user credentials and fragments in the URL, since the URL is stored readable and only the headers are encrypted.
• Tests: the schema accepts an HTTP issuer on loopback and on a private service name, and still rejects another scheme, credentials, and a fragment. The API process fetches an HTTP issuer at provisioning, and the exchange fetches one on first use. No CA is involved on either path.
• docs/security.md and docs/deploy.md say plain HTTP inside the deployment, HTTPS outside it.
• Issuer header values must be printable ASCII, and a header h11 refuses raises an IssuerError with no chain. A test proves the value stays out of the error.

Where this differs from the ticket

• The ticket names docs/architecture.md too. It states no scheme rule, so it does not change.
• No setting and no private-address rule. Inside the deployment the exchange already answers the proxy in the clear, so a rule here protects nothing. A setting would be one more knob on every deployment whose issuer is local.

Names

Renamed: the validator require_secure_issuer is refuse_secrets_in_url, which is what it checks now. New: refuse_control_characters on the headers.

Gates

uv run ruff check, uv run ruff format --check, uv run pyright, and uv run pytest are green.

Review

The adversarial review reported one finding, applied. The schema accepted a header value with a trailing newline. h11 refused it at request time with the whole value in its message, Secret.fetch chained that message, and the provisioning failure log carried the chain. The defect predates this branch and reached the HTTP path too. Header values are printable ASCII now, and the h11 refusal raises a fixed message with no chain.