`webhook_url` accepts `http://` despite README requiring HTTPS

[Darkdruce]

Summary

Validation accepts both http:// and https://, so webhook payloads (with merchant_id, amounts, tx hashes) can be delivered in cleartext.

Location

• src/api/payments.rs:130
• README API table states webhook_url must be a "Valid HTTPS URL".

Details & impact

Cleartext webhook delivery exposes signed event bodies and headers to on-path attackers and contradicts the documented contract.

Suggested fix

Reject http:// on the public network (allow only for local/testnet dev, gated by config), and align the README/OpenAPI.

Acceptance criteria

• http:// webhook URLs are rejected in production.
• Docs and code agree.

[whiteghost0001]

Hi! I'm a full-stack developer with experience building modern web applications using JavaScript/TypeScript, React, Next.js, Node.js, and blockchain technologies such as Stellar. I enjoy working on open-source projects, writing clean, maintainable code, and collaborating with the community.

I'd love to work on this issue. I believe I can contribute a high-quality solution, communicate my progress clearly, and submit a well-tested pull request. If the issue is still available, I'd appreciate being assigned to it. Thank you!

[grantfox-oss]

🦊 GrantFox — @whiteghost0001 has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #69)
2. Your PR will be reviewed by the StellarGateLabs maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign | FWC26 campaign!

@whiteghost0001's PR #164 was approved and merged by @Manuel1234477.

🏆 @whiteghost0001: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (519 total points). Track your full progress on GrantFox.

👏 Great work, @whiteghost0001! Keep contributing to StellarGateLabs.