[MEDIUM] Docling HTTP client does not enforce TLS

[pradeepto]

Description

pkg/docling/client.go:171-173

The Docling client creates a plain http.Client without enforcing TLS:

client := &http.Client{
    Timeout: 15 * time.Second,
}

DoclingServeURL is user-configured via the ControllerConfig CRD and could be set to a plain HTTP endpoint. The API key is sent in the Authorization header and presigned S3 URLs are sent in the request body — both over a potentially unencrypted connection.

Fix

Validate that the URL scheme is HTTPS or at minimum log a warning for non-TLS URLs:

if !strings.HasPrefix(endpoint, "https://") {
    logger.Info("WARNING: Docling endpoint not using HTTPS, credentials may be in cleartext")
}