Allowed insecure OIDC connections for http backends

lib/config/oidc_config.dart

@@ -34,6 +34,11 @@ class OidcSettings {
   /// Deep-link scheme the provider redirects back to (e.g. `schulytest`),
   /// derived from [redirectUri] so the app never hardcodes it.
   String get callbackScheme => Uri.parse(redirectUri).scheme;
+
+  /// Whether the OIDC endpoints use plaintext `http://` (a self-hosted / local
+  /// backend). flutter_appauth rejects http unless told to allow it, so this
+  /// gates `allowInsecureConnections`; https providers stay strict.
+  bool get allowInsecureConnections => Uri.parse(authorizationEndpoint).scheme == 'http' || Uri.parse(tokenEndpoint).scheme == 'http';
 }
 
 class OidcConfig {

lib/services/auth_service.dart

@@ -85,6 +85,7 @@ class AuthService {
         serviceConfiguration: _serviceConfig(cfg),
         scopes: cfg.scopes,
         promptValues: register ? const ['create'] : null,
+        allowInsecureConnections: cfg.allowInsecureConnections,
       ),
     );
     return _persist(result);
@@ -146,6 +147,7 @@ class AuthService {
           serviceConfiguration: _serviceConfig(cfg),
           refreshToken: refreshToken,
           scopes: cfg.scopes,
+          allowInsecureConnections: cfg.allowInsecureConnections,
         ),
       );
       final tokens = await _persist(result);
@@ -187,6 +189,7 @@ class AuthService {
             idTokenHint: idToken,
             postLogoutRedirectUrl: cfg.redirectUri,
             serviceConfiguration: _serviceConfig(cfg),
+            allowInsecureConnections: cfg.allowInsecureConnections,
           ),
         );
       }