fix(12): IN-01 require https:// on appExternalUrl in configSchema

appExternalUrl is injected as OIDC_AUTH_EXTERNAL_URL (the redirect URI
base); Authelia rejects non-https redirect URIs in production. Added
.refine() guard matching the existing oidcIssuer pattern. Added test
that verifies http:// appExternalUrl is rejected with 400.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/api/src/routes/setup.ts

@@ -63,7 +63,11 @@ const configSchema = z.object({
     .refine((v) => v.startsWith('https://'), { message: 'oidcIssuer must be an https URL' }),
   oidcClientId: z.string().min(1).max(256),
   vapidPublicKey: z.string().min(1).max(512),
-  appExternalUrl: z.string().url().max(512),
+  appExternalUrl: z
+    .string()
+    .url()
+    .max(512)
+    .refine((v) => v.startsWith('https://'), { message: 'appExternalUrl must be an https URL' }),
 });
 
 const credentialSchema = z.object({