[umpireboulianne-design]

Summary

• Add assertEndpointTransportSecurity, isMainnetPassphrase, and isLoopbackHost in packages/sdk/src/network.ts (re-exported from @sub-rosa/sdk) and wire into SubRosaClient so mainnet (Public Global Stellar Network ; September 2015) always requires https:// (even if allowHttp is passed or the host is loopback), while non-mainnet development requires explicit allowHttp: true for http://.
• Promote http:// RPC URLs from "warn" to "block" in packages/sdk/src/mainnet-readiness.ts (rpcUrlCheck).
• Enforce https:// in services/appraisal-api/src/config.ts (parseRpcUrl) whenever X402_NETWORK=stellar:pubnet or when a non-loopback remote host is configured on testnet, while keeping http://localhost / http://127.0.0.1 allowed on testnet.
• Add assertDrandEndpointUrl and DEFAULT_QUICKNET_URL in packages/tlock/src/quicknet.ts (re-exported from @sub-rosa/tlock) and wire into quicknet() so remote http:// Drand endpoints are rejected and local loopback http:// requires allowLocalHttp: true.
• Document the RPC_URL transport security rules in services/appraisal-api/README.md and add unit tests across packages/sdk, services/appraisal-api, and packages/tlock.

Supply-chain review

• No package scripts or dependencies changed. If changed, explain why below.
• No .vscode/, workflow, or other editor/config file changes. If changed, list them below.
• No lockfile changes. If changed, explain the update below.
• No binary or font asset changes. If changed, list and justify them below.
• I confirm no automatic task (such as preinstall/postinstall) was added.
• I confirm no hidden executable payload (encoded blob, obfuscated command, or unexpected binary) was added.
• Any changed executable or binary was reviewed by a maintainer.

Testing

• node --import tsx/esm --test src/network.test.ts src/mainnet-readiness.test.ts src/public-api-snapshot.test.ts in packages/sdk (passes)
• node --import tsx/esm --test src/config.test.ts in services/appraisal-api (21/21 tests pass)
• node --import tsx/esm --test src/quicknet.test.ts in packages/tlock (11/11 tests pass)
• node scripts/check-direct-time-access.mjs (passes)

Closes #536
Fixes #536