Set the prod backend URL in builds and warned on insecure custom backends

[PianoNic]

• The release workflow and prod build scripts now pass --dart-define=BACKEND_BASE_URL (defaulting to https://api.schuly.dev via an optional BACKEND_BASE_URL repo variable); previously the published prod app fell back to the http://localhost build default.
• The server dialog (settings + onboarding) now warns when a custom backend uses plaintext http:// for a non-loopback host.

Closes #414