The move-card unit tests added a mock httpx.Request with an http:// URL, which SonarCloud flags as a new security hotspot (insecure protocol), failing the new-code quality gate. The URL is never dialed (it only labels a synthetic HTTPStatusError), but switch it to https to keep the gate green. Also simplify the done-PUT mock to a bare 200 response, since that response is discarded by the implementation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>