OCI token realm advertises a hardcoded http:// scheme behind TLS-terminating proxies

The Docker-registry token flow builds the WWW-Authenticate realm with a hardcoded http:// scheme, so behind a TLS-terminating proxy (every production and self-managed deployment) the challenge reads Bearer realm="http://<host>/v2/auth/token". crane rejects the registry outright (realm scheme "http" not allowed for a secure registry), and clients that honor the realm (docker, oras) send Basic credentials to a cleartext URL. Reproduced against a live deployment behind nginx-ingress with TLS.

Not a security incident: AR is not yet released, so no users are exposed.

Fix: derive the realm scheme per request, with r.TLS authoritative and a valid X-Forwarded-Proto consulted only on non-TLS requests.