backend: require HTTPS AOPP callbacks

[benma-agent]

Reject AOPP requests whose callback is not an absolute HTTPS URL
with a non-empty host. Allow redirects only while HTTPS is preserved
so signed addresses and extended public keys cannot be downgraded to
cleartext transport.

Make AOPP error rendering tolerate missing or malformed callback URLs.
Cover callback validation, HTTPS redirects, HTTP downgrade rejection,
and missing callbacks in backend and frontend tests.

[bznein]

Codex findings:

• The HTTPS restriction can still downgrade through redirects, and its newly rejected
  HTTP path sends frontend state that crashes error rendering. Both defects undermine
  the intended secure failure behavior.

  Full review comments:

  - [P1] Preserve rejected callbacks for error rendering — /home/bznein-coding-agent/
    agent-work/bitbox-wallet-app/backend/aopp.go:260-262
    When an AOPP URI contains a parseable HTTP callback, this branch sets the error
    before backend.aopp.Callback is assigned, so the frontend receives an empty
    callback. The error view calls new URL(aopp.callback).host in frontends/web/src/
    components/aopp/aopp.tsx, which throws and blanks the flow instead of displaying
    aoppInvalidRequest; preserve the parseable callback or make error rendering tolerate    absent callbacks.

  - [P1] Reject cleartext redirect targets — /home/bznein-coding-agent/agent-work/
    bitbox-wallet-app/backend/aopp.go:257-259
    When an accepted HTTPS callback responds with a 307 or 308 redirect to an HTTP URL,
    Go's default http.Client.Post follows it and resends the signed address and optional    xpub over cleartext. Validating only the initial URL therefore does not enforce the
    new transport guarantee; disable redirects for this callback or reject every
    redirect whose target is not HTTPS.

[bznein]

[nit] I think we can avoid this check, because this simply does:

func (u *URL) IsAbs() bool {
	return u.Scheme != ""
}

And if the scheme is empty it would fail anyway the EqualFold check blow.

[benma]

Fixed

[benma]

Addressed. It's overengineered for sure for something that is basically a non-issue in practice, but oh well...