feat(channel): support insecure TLS verification

[BugMasterLab]

Summary

• add a per-channel option to skip HTTPS certificate verification while keeping secure verification as the default
• apply the option to both model discovery and saved-channel upstream requests without leaking TLS settings across channels
• preserve existing channel settings and global SSL behavior, with GraphQL, UI, locale, and focused test coverage

Test plan

• Verify secure clients still reject untrusted test certificates
• Verify per-channel insecure clients accept untrusted certificates without mutating the shared client
• Verify model fetching and channel requests honor the per-channel TLS setting
• Build the frontend production assets with pnpm -C frontend build

[greptile-apps]

Greptile Summary

This PR adds per-channel control over HTTPS certificate verification. The main changes are:

• A secure-by-default channel setting exposed through GraphQL and the UI.
• Per-channel TLS handling for model discovery and saved-channel requests.
• Isolated HTTP transport cloning to prevent TLS settings from leaking across channels.
• Locale updates and focused backend and HTTP-client tests.

Confidence Score: 5/5

The main channel flow looks safe to merge after a small compatibility cleanup for custom transports.

• Secure verification remains the default.
• Standard transports are cloned without leaking TLS state across channels.
• Custom RoundTrippers lose their wrapper behavior when the new option is enabled.

llm/httpclient/client.go fallback handling for non-standard RoundTrippers.

Important Files Changed

Filename	Overview
llm/httpclient/client.go	Adds isolated TLS configuration, but replaces custom RoundTrippers with a fallback transport.
internal/server/biz/channel_llm.go	Applies proxy and TLS settings to a derived per-channel HTTP client.
internal/server/biz/model_fetcher.go	Applies explicit or stored channel TLS settings during model discovery.
frontend/src/features/channels/components/channels-action-dialog.tsx	Adds the channel TLS checkbox, warning, reset behavior, model-fetch input, and save handling.
internal/server/gql/axonhub.graphql	Exposes the optional TLS setting for channel configuration and model discovery.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  UI[Channel TLS setting] --> GQL[GraphQL settings]
  GQL --> Stored[Stored channel]
  UI --> Discovery[Model discovery]
  Stored --> Requests[Upstream requests]
  Discovery --> Client[Derived HTTP client]
  Requests --> Client
  Client --> TLS[TLS verification policy]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart LR
  UI[Channel TLS setting] --> GQL[GraphQL settings]
  GQL --> Stored[Stored channel]
  UI --> Discovery[Model discovery]
  Stored --> Requests[Upstream requests]
  Discovery --> Client[Derived HTTP client]
  Requests --> Client
  Client --> TLS[TLS verification policy]

Loading

_{Reviews (1): Last reviewed commit: "feat(channel): support insecure TLS veri..." | Re-trigger Greptile}

[greptile-apps]

Custom RoundTripper Is Discarded

When an HttpClient uses a non-*http.Transport RoundTripper, enabling insecureSkipVerify replaces it with this fallback transport. Clients created with an authentication, tracing, or routing wrapper then bypass that wrapper, causing requests to lose its behavior instead of only changing TLS verification.

[looplj]

有冲突