feat: add explicit insecure HTTP opt-in across Agent integrations

[frf12]

Problem

When a user copies a remote Dashboard URL such as http://192.0.2.10:8000 into an Agent integration, setup or the prompt hook rejects it because plaintext HTTP is restricted to loopback. This is difficult to diagnose during remote development and acceptance testing, especially when the host continues normally after a hook failure.

Transport behavior also differs between the standalone Python hooks, TypeScript plugins, SDK adapters, and host-managed MCP connections.

Proposed behavior

• Keep HTTPS and loopback HTTP as the default supported transports.
• Add an explicit client-side --allow-insecure-http opt-in for remote plaintext HTTP.
• Interactive setup resolves the effective URL (including environment configuration) and asks a default-No question before installation if remote HTTP needs consent. Explain that credentials and content travel unencrypted.
• Noninteractive and JSON setup never prompt; require an explicit flag or environment opt-in.
• Save the selected endpoint and consent for that host so a new Agent session uses the same decision. Saved consent does not silently authorize a different endpoint.
• Support POWERCONTEXT_CLIENT_ALLOW_INSECURE_HTTP, with host-specific overrides including explicit false.
• Show the insecure transport as a warning in diagnostics while still reporting actual connection results.
• Cover Codex, Claude Code, WorkBuddy, DSH, OpenCode, Pi, Hermes, OpenClaw, shared Python adapters, and document the host-managed MCP boundary for generic Agent Plugins and MiniMax.
• Do not change Server bind/authentication policy or disable TLS certificate validation.

Acceptance

Test public/private HTTP addresses, HTTPS, IPv4/IPv6 loopback, CLI/environment/persisted precedence, declined and noninteractive consent, endpoint changes, fresh-session settings, and native MCP/Hook endpoint consistency. Installation alone must not be reported as full model/Agent end-to-end verification.