fix: reject whitespace and control characters in base URLs and warn on plain http Gitea (SEC-10)

docs/configuration.md

@@ -36,7 +36,7 @@ when OAuth is on.
 
 | Variable | Default | Rules |
 |---|---|---|
-| `GITEA_URL` | required | `http` or `https`, must have a host, no credentials, query or fragment. A trailing `/api/v1` is removed. |
+| `GITEA_URL` | required | `http` or `https`, must have a host, no credentials, query or fragment, and no whitespace, backslash or control characters. A trailing `/api/v1` is removed and the URL is rebuilt from its parsed parts. Plain `http` to a host that is not loopback starts, but `serve` prints a warning on stderr because every token then travels unencrypted. |
 | `GITEA_TOKEN` | unset | Token for stdio and for admin-token mode on HTTP. Its scopes bound what the server can do. Required for stdio (exit code 2 without it). |
 
 ## Transport