#4431 fix(upload): constrain forwarded ticket schemes

Summary

Constrain forwarded schemes to case-insensitive HTTP(S) before building credentialed upload-ticket URLs in the daemon and proxy. Preserve request authority, non-default ports, upload prefix/query and credentials. URL-shaped headers cannot replace authority. Six files change; scope includes fixture cleanup and forwarding-trust guidance. Fixes #4419; part of #4368.

Validation

Head f61dffd03b23f11110a439919b971894e01c7c2a; base 3924da9474eded3d40c4abbaccc79fecae894366.

• Nine runnable exact-head checks passed; exactCommit=true, checkoutChanged=false. Full units: 19,030passed/3skipped. Related: 329passed. Seven selected GitHub/manual lanes remain skips. Receipt, proof and obligations.
• Focused preflight/proxy/wire suites: 85passed. Published7e with final preflight/proxy tests: 5failed/38passed; corrected: 43passed. A separate HTTPS+Host:80 case independently fails then passes. Experiments removed; source preserved.
• Original base3924 security proof: 3failed/36passed; corrected39passed, including a targeted hostile-header authority case.
• Existing ticket URL parsing already canonicalizes host case/default ports. Scheme selection now precedes that parsing; the ledger rationale records unchanged wire compatibility. Test-owned runtime disposal removes retained uploads and timers.
• Independent runtime review found no findings. The final README/API-comment delta documents the first forwarded value and ingress replacement; #4434 owns trust-policy defaults. No prose-pinning tests added.
• Install/build and full formatting passed. Fresh CI/reviews are pending. No live device is required.