P1: Implement C7/C8 in the reference HTTP transport: auth-carrying connect API, TLS refusal, credential redaction

[macanderson]

Problem

The HTTP transport has no authentication and no transport-security requirements.

• HttpProvider::connect(id, url) (contextgraph-host/src/http.rs:38) builds a plain reqwest client — there is no way to attach a bearer token, API key header, or mTLS identity. Essentially every real remote provider (a hosted docs index, an org-internal knowledge graph) will require credentials, so today the HTTP story only works for anonymous endpoints.
• Nothing in the spec forbids plain http:// to a non-loopback provider. The consent gate correctly ensures the user agreed that workspace content leaves the machine — and then the protocol is silent on whether it leaves in cleartext. Consent to egress is not consent to interception.

Worth preserving as-is: the transport-forced egress rule (http.rs:72-80 — every remote is treated as egress regardless of its handshake claim) is exactly right and should be lifted from code comment into normative spec text if it isn't already (C4).

Proposal

1. Connect-time auth config: HttpProvider::connect_with(id, url, HttpConfig { bearer: Option<String>, headers: HeaderMap, timeout: … }). Static bearer + arbitrary headers covers the practical 90%; OAuth/OIDC device flows stay out of scope for 1.0 (document as a host concern — the host obtains the token, the transport carries it).
2. Normative transport rules in the spec: a host MUST use https for non-loopback provider URLs (loopback exempt for local dev); credentials MUST NOT be logged or echoed into conformance evidence strings; a 401/403 response maps to a distinct, named HostError variant (auth failure ≠ transport failure — hosts should prompt for credentials, not retry).
3. Conformance: contextgraph-inspect accepts --bearer/--header so a credentialed provider can actually be conformance-tested.

Acceptance criteria

• Auth-carrying connect API on HttpProvider
• https-required rule (with loopback exemption) in the spec's transport section
• Named auth-failure error variant, distinct from Transport
• contextgraph-inspect can test a credentialed endpoint

[macanderson]

Re-verified 2026-07-26 against origin/main @ 1ee9b1c. Retitled — the spec half shipped; the implementation half is untouched.

What landed (PR #60): the normative rules. C7 mandates TLS for non-loopback transports and requires refusal to transmit credentials unencrypted; C8 forbids logging credentials. The spec sub-item can be ticked.

What survives: everything code-side. http.rs:43 builds a bare reqwest client with no auth API at all — there is no way to attach a credential, so there is nothing for C7 to refuse — and HostError has no auth variant, so a 401 is indistinguishable from any other transport failure. C7 is normative but unimplemented even in the reference host, which is the worst of both worlds: conformance-relevant text with no witness.

Recommended scope: the implementation half only — an auth-carrying connect API, TLS refusal for non-loopback targets, and credential redaction in the reference HTTP transport.