feat(worker): adopt canonical public URL

cmd/rsmon-worker/main.go

@@ -76,6 +76,14 @@ func main() {
 	if err := webapp.ValidateBasicAuth(cfg.HTTP.Login, cfg.HTTP.Password); err != nil {
 		log.Fatalf("worker: %v", err)
 	}
+	// Enforce the advertised PUBLIC_URL origin rules (and the
+	// production HTTPS policy) before accepting work. willListen=false
+	// because the webapp's both-empty local bcrypt mode is legitimate
+	// and already gated by ValidateBasicAuth above; here we only check
+	// the URL invariants.
+	if err := distworker.ValidateHTTPConfig(cfg.HTTP, false); err != nil {
+		log.Fatalf("worker: %v", err)
+	}
 
 	runner := distworker.NewRunner(&cfg)
 
@@ -501,20 +509,30 @@ func logHTTPSettings(h distworker.HTTPConfig, willListen bool) {
 	if h.Login == "" {
 		login = "(empty)"
 	}
-	url := h.URL
+	url := h.PublicURL
 	if url == "" {
 		url = "(empty)"
 	}
-	log.Printf("worker http settings: host=%s port=%d url=%s login=%s will_listen=%t",
+	log.Printf("worker http settings: host=%s port=%d public_url=%s login=%s will_listen=%t",
 		h.Host, h.Port, url, login, willListen)
-	if h.URL != "" {
-		if host, warn := distworker.WarnInsecurePublicURL(h.URL); warn {
+	if h.PublicURL != "" {
+		if host, warn := distworker.WarnInsecurePublicURL(h.PublicURL); warn {
+			label := distworker.EnvPublicURL
+			if h.URLSource == distworker.PublicURLSourceLegacy {
+				label = distworker.EnvWorkerURLLegacy
+			}
 			log.Printf(
-				"worker http settings: WARN WORKER_URL=http://%s uses plain HTTP on a non-loopback host; "+
-					"production deployments usually terminate TLS at a reverse proxy", host,
+				"worker http settings: WARN %s=http://%s uses plain HTTP on a non-loopback host; "+
+					"production deployments usually terminate TLS at a reverse proxy", label, host,
 			)
 		}
 	}
+	if _, source := distworker.PublicURLFromEnv(); source == distworker.PublicURLSourceLegacy {
+		log.Printf(
+			"worker http settings: WARNING WORKER_URL is deprecated (bounded migration); " +
+				"rename it to PUBLIC_URL before it is removed (docs/public-endpoint-and-identity.md milestone 1)",
+		)
+	}
 }
 
 func loadDotEnv() {