fix(api): enforce HTTPS webhook URLs in production

[whiteghost0001]

This pull request addresses the security requirement of enforcing HTTPS schemes for webhook URLs on public deployments (mainnet). Insecure HTTP schemes remain allowed under testnet and local development environments to preserve developer experience.

What Changed

• payments.rs: Migrated to parsing webhook_url using reqwest::Url::parse for structural validation. Enforces https scheme when the configuration network is "public". Permissive http and https schemes are allowed otherwise.
• api_tests.rs: Replaced test_reject_bad_webhook_url with 5 integration tests (test_webhook_url_https_accepted_on_testnet, test_webhook_url_http_accepted_on_testnet, test_webhook_url_http_rejected_on_public_network, test_webhook_url_https_accepted_on_public_network, and test_webhook_url_invalid_rejected).
• README.md & openapi.yaml: Aligned user-facing documentation to document this network-specific behavior.

Why the Change Was Necessary
In public production networks, sending webhooks over insecure HTTP exposes sensitive gateway payload data—such as merchant IDs, payment amounts, and transaction hashes—to interception and man-in-the-middle modifications. Enforcing HTTPS protects transport-layer privacy.

Security Impact
Prevents merchants from configuring insecure webhook destinations in production deployments, protecting payment settlement notifications against eavesdropping and injection attacks.

Testing Performed

• Validated all new integration tests under public and testnet network configurations.
• Ran quality checks (cargo test, cargo fmt -- --check, and cargo clippy --all-targets --all-features -- -D warnings). All checks passed with zero errors or warnings.

Checklist for Reviewers

• No panic() or unsafe unwrap statements.
• Validation is minimal and reuses existing types (reqwest::Url).
• Permissive HTTP behavior is maintained in non-production environments.
• API specification and README have been updated.
• All automated tests pass successfully.

closes #69