fix(s52): reject scheme-less webhook URL fail-fast in NotifierConfig

src/portfolio_optimiser/notify.py

@@ -23,7 +23,7 @@ from typing import TYPE_CHECKING, Any, Protocol, TextIO, runtime_checkable
 from urllib.error import URLError
 from urllib.request import Request, urlopen
 
-from pydantic import BaseModel, model_validator
+from pydantic import BaseModel, ConfigDict, model_validator
 
 if TYPE_CHECKING:  # verdicts imports agent_framework — keep it out of the runtime import graph
     from portfolio_optimiser.verdicts import Verdict
@@ -141,6 +141,10 @@ class NotifierConfig(BaseModel):
     ``allow_egress`` field — egress opt-in is a code-level factory kwarg, so config alone can
     never grant it (mirrors ingest's ``allow_network`` discipline)."""
 
+    # the url field is secret-bearing (webhook URLs embed the receiver secret), so
+    # validation errors must not echo input (pydantic would render input_value='…secret')
+    model_config = ConfigDict(hide_input_in_errors=True)
+
     type: str
     url: str | None = None
     path: str | None = None
@@ -149,6 +153,8 @@ class NotifierConfig(BaseModel):
     def _required_fields_by_type(self) -> NotifierConfig:
         if self.type == "webhook" and not self.url:
             raise ValueError("webhook notifier config requires a non-empty url")
+        if self.type == "webhook" and self.url and not self.url.startswith(("http://", "https://")):
+            raise ValueError("webhook notifier url must start with http:// or https://")
         if self.type == "file" and not self.path:
             raise ValueError("file notifier config requires a non-empty path")
         return self