SonarCloud flagged the http:// mock URLs in the new login_url-rewrite test as clear-text-protocol hotspots, failing the new-code quality gate (they were new + unreviewed). They're harmless test fixtures; switch to https mock origins to match this file's existing convention. The login_url rewrite is scheme-agnostic so the test still exercises the same internal->public origin replacement. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>