fix: require HTTPS for owner activation links

Tiku.UnitTests/Tenancy/TenantOwnerActivationUrlPolicyTests.cs

@@ -0,0 +1,48 @@
+using Tiku.Application.PlatformAdmin;
+
+namespace Tiku.UnitTests.Tenancy;
+
+public sealed class TenantOwnerActivationUrlPolicyTests
+{
+    [Fact]
+    public void Custom_domain_always_uses_secure_activation_origin()
+    {
+        var id = Guid.NewGuid();
+        var options = new TenantProvisioningOptions
+        {
+            OwnerActivationUrlTemplate = "https://{host}",
+            DevelopmentLocalhostOwnerActivationUrlTemplate = "http://{host}:5180"
+        };
+
+        var url = TenantOwnerActivationUrlPolicy.Build(options, "School.Example.Test", id, "secret");
+
+        Assert.Equal($"https://school.example.test/activate/{id}#token=secret", url);
+    }
+
+    [Fact]
+    public void Development_localhost_can_use_explicit_http_origin()
+    {
+        var id = Guid.NewGuid();
+        var options = new TenantProvisioningOptions
+        {
+            OwnerActivationUrlTemplate = "https://{host}",
+            DevelopmentLocalhostOwnerActivationUrlTemplate = "http://{host}:5180"
+        };
+
+        var url = TenantOwnerActivationUrlPolicy.Build(options, "school.localhost", id, "secret");
+
+        Assert.Equal($"http://school.localhost:5180/activate/{id}#token=secret", url);
+    }
+
+    [Fact]
+    public void Insecure_custom_domain_template_is_rejected()
+    {
+        var options = new TenantProvisioningOptions
+        {
+            OwnerActivationUrlTemplate = "http://{host}"
+        };
+
+        Assert.Throws<InvalidOperationException>(() =>
+            TenantOwnerActivationUrlPolicy.Build(options, "school.example.test", Guid.NewGuid(), "secret"));
+    }
+}