fix: require HTTPS for Redmine URL

Config.validate() now rejects REDMINE_URL values whose scheme is not
HTTPS (http://, missing scheme, or any other scheme). The API key is
sent in request headers, so a plain-HTTP endpoint would expose it.
Scheme comparison is case-insensitive per RFC 3986.

Closes #54

tests/test_config.py

@@ -126,6 +126,56 @@ def test_get_redmine_verify_custom_path():
     assert Config.get_redmine_verify() == "/tmp/redmine-ca.pem"
 
 
+# -- #54: REDMINE_URL обязан использовать HTTPS --
+
+
+class TestConfigRequiresHttpsUrl:
+    """Config.validate() отклоняет URL без TLS: API-ключ идёт в заголовках."""
+
+    @mock.patch.dict(
+        os.environ,
+        {"REDMINE_URL": "http://red.eltex.loc/", "REDMINE_API_KEY": "token"},
+        clear=True,
+    )
+    def test_http_url_rejected(self):
+        with pytest.raises(ValueError, match="HTTPS"):
+            Config.validate()
+
+    @mock.patch.dict(
+        os.environ,
+        {"REDMINE_URL": "red.eltex.loc", "REDMINE_API_KEY": "token"},
+        clear=True,
+    )
+    def test_url_without_scheme_rejected(self):
+        with pytest.raises(ValueError, match="HTTPS"):
+            Config.validate()
+
+    @mock.patch.dict(
+        os.environ,
+        {"REDMINE_URL": "ftp://red.eltex.loc/", "REDMINE_API_KEY": "token"},
+        clear=True,
+    )
+    def test_non_http_scheme_rejected(self):
+        with pytest.raises(ValueError, match="HTTPS"):
+            Config.validate()
+
+    @mock.patch.dict(
+        os.environ,
+        {"REDMINE_URL": "https://red.eltex.loc/", "REDMINE_API_KEY": "token"},
+        clear=True,
+    )
+    def test_https_url_accepted(self):
+        Config.validate()
+
+    @mock.patch.dict(
+        os.environ,
+        {"REDMINE_URL": "HTTPS://red.eltex.loc/", "REDMINE_API_KEY": "token"},
+        clear=True,
+    )
+    def test_uppercase_scheme_accepted(self):
+        Config.validate()
+
+
 # -- #15: .env не должен переопределять переменные окружения --