[UX/Security] No warning when connecting to a plain HTTP endpoint

[whaiman]

Context

ApiClient accepts any endpoint URL. When the user configures http:// instead of https://, the ECDH handshake and encrypted payload are sent over plain HTTP. A network-level attacker can MITM the handshake and substitute their own public key, breaking the forward-secrecy guarantee.

Location: rgcc/client/transport/api.py, lines 18–22

Proposed fix

if self.endpoint.startswith("http://"):
    logger.warning(
        "Connecting over plain HTTP — the ECDH handshake is exposed to MITM. "
        "Use HTTPS for production deployments."
    )