fix: require HTTPS for owner activation links

Tiku.Api/Configuration/NetworkConfigurationExtensions.cs

@@ -60,8 +60,9 @@ internal static class NetworkConfigurationExtensions
                                      options.OwnerActivationUrlTemplate.Replace("{host}", "tenant.example.com", StringComparison.Ordinal),
                                      UriKind.Absolute,
                                      out var activationOrigin) &&
-                                 (activationOrigin.Scheme == Uri.UriSchemeHttp || activationOrigin.Scheme == Uri.UriSchemeHttps),
-                "Tenant provisioning requires a default offering code, valid trial/activation durations, and an absolute HTTP(S) owner activation URL template containing {host}.")
+                                 activationOrigin.Scheme == Uri.UriSchemeHttps &&
+                                 ValidateDevelopmentActivationTemplate(options, environment.IsDevelopment()),
+                "Tenant provisioning requires a default offering code, valid trial/activation durations, an HTTPS owner activation URL template, and permits an HTTP template only for Development .localhost sites.")
             .ValidateOnStart();
         if (environment.IsProduction())
         {
@@ -107,4 +108,24 @@ internal static class NetworkConfigurationExtensions
 
         return services;
     }
+
+    private static bool ValidateDevelopmentActivationTemplate(
+        TenantProvisioningOptions options,
+        bool isDevelopment)
+    {
+        if (string.IsNullOrWhiteSpace(options.DevelopmentLocalhostOwnerActivationUrlTemplate))
+        {
+            return true;
+        }
+
+        return isDevelopment &&
+               options.DevelopmentLocalhostOwnerActivationUrlTemplate.Contains("{host}", StringComparison.Ordinal) &&
+               Uri.TryCreate(
+                   options.DevelopmentLocalhostOwnerActivationUrlTemplate.Replace(
+                       "{host}", "tenant.localhost", StringComparison.Ordinal),
+                   UriKind.Absolute,
+                   out var developmentOrigin) &&
+               (developmentOrigin.Scheme == Uri.UriSchemeHttp ||
+                developmentOrigin.Scheme == Uri.UriSchemeHttps);
+    }
 }