fix(admin): preserve HTTPS for upstream Swagger documents - #7895

Approving. The transport scheme was indeed lost twice — once by split(":") in the two LoadServiceDocEntryImpl conversion paths, then again by the hardcoded scheme("http") in PullSwaggerDocServiceImpl and the hardcoded "http://" protocol in DocManagerImpl#buildExtJson.

What I verified:

• UriUtils.appendScheme only prepends when the url does not already start with http:///https://, so a discovery entry that already carries a scheme keeps it and getProtocol() is correctly ignored in that case.
• UriUtils.getActualPort returns 443 for https/wss and 80 for http/ws when the port is absent, which is what makes https://example.com resolve to https://example.com:443 rather than https://example.com:80.
• URI.getHost() keeps the brackets on IPv6 literals, so https://[::1]:8443 round-trips through UriComponentsBuilder.host(...) correctly. The previous split(":") produced [ as the host, so this is a fix rather than a behaviour change to preserve.
• SwaggerUpstreamProtocolTest swaps the OkHttpClient inside the shared HttpUtils and asserts the recorded request URL, so it proves the URL that actually goes over the wire for both the startup scan and the discovery callback, across https://, bare https, http://, empty, and IPv6 forms. That is the right seam to assert at.

Non-blocking observations:

1. buildExtJson now writes https:// into the selector's protocol ext for HTTPS upstreams. That is the point of the change, but it also means the gateway will start using TLS for upstreams that previously received plaintext requests on an https://-advertised discovery entry (a common shape behind a TLS-terminating sidecar or service mesh). Existing rows keep their old ext_json until the next scan rewrites them, so this needs a line in the release/upgrade notes rather than only a code comment.
2. getScheme() returns the raw field. buildExtJson concatenates it unconditionally, so a null scheme would emit "protocol": "null://". The field initialiser covers the normal path, but UpstreamInstance also looks like a DTO that can be populated from ext_json, so StringUtils.defaultIfBlank(scheme, "http") in the getter would make it impossible to produce that string.
3. URI.create(...) throws on inputs the old split(":") silently tolerated (example.com:8080:extra, stray spaces, a scheme other than http/https). Both call sites are inside a single try around the whole stream, so one malformed upstream still discards every instance for that selector. The change widens the set of inputs that can trigger that. A per-item try/catch inside the map (log and skip) would keep one bad row from hiding the healthy ones.
4. Adding scheme to equals/hashCode changes instance identity: http://host:8443 and https://host:8443 used to collapse into one entry and now do not. That is correct, but it also means every HTTPS upstream re-registers its doc metadata once after this lands. Worth mentioning in the PR description so it is not mistaken for a regression.
5. SwaggerUpstreamProtocolTest mutates the static PullSwaggerDocServiceImpl.HTTP_UTILS singleton and restores it in finally. That is safe today because admin tests are not parallel, but it is a global write from a test. A constructor-injected HttpUtils (or a package-private setter) would remove the landmine and make the test independent of reflection on a private static field.
6. The @CsvSource rows duplicate the same seven cases for the scan and the event path. If a case is added later it has to be added twice; a single source feeding both entry points, or a @MethodSource, would keep them in lockstep.