[kinqsradio]

Summary

• Test that HttpApi never follows a redirect: a loopback server answers 301, 302, 303, 307 and 308 with a Location to a second loopback listener; GET, POST, PUT and DELETE with a bearer token each come back as the redirect answer, and the second listener sees no connection (the older test redirected to a closed port, which proved nothing).
• Plain http is refused for any host that is not a loopback IP literal (example.com, localhost, 10.0.0.1, a private port, [2001:db8::1], 127.0.0.1.example.com); loopback http and https are allowed.
• docs/device-client.md already states that redirects are off; one line added to the tests list.
• Test only; no behaviour change.

Testing

• Full gate with Postgres: fmt, clippy, structure, wasm32, workspace tests (993 pass).
• Mutation: redirect::Policy::default() makes the test fail.
• Not tested: the CI clippy toolchain (local only).

Co-authors

none

AI usage

• Written by hand, with no AI
• Harness and version: Claude Code 2.1.317
• Models: claude-sonnet-5-5 (all)
• Effort: medium
• Human role: set scope (gate follow-up 9)
• Sources: none

Checklist

• Works on Windows, macOS and Linux
• docs/architecture.md with any rule change; generated wire types with any contract change
• No copied source, secrets, credentials or personal data; no AI attribution in commits, title or branch