feat(wpmc S5): RestUrlFilter forces HTTPS + preserves HTTP_HOST

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

includes/class-rest-url-filter.php

@@ -0,0 +1,22 @@
+<?php
+declare(strict_types=1);
+
+namespace WPMultiCity;
+
+final class RestUrlFilter
+{
+    public static function register(): void
+    {
+        \add_filter('rest_url', [self::class, 'preserve_host']);
+    }
+
+    public static function preserve_host(string $url): string
+    {
+        $host = $_SERVER['HTTP_HOST'] ?? '';
+        if ($host === '') {
+            return $url;
+        }
+        $replaced = preg_replace('#^https?://[^/]+#', 'https://' . $host, $url);
+        return is_string($replaced) ? $replaced : $url;
+    }
+}

tests/RestUrlFilterTest.php

@@ -0,0 +1,37 @@
+<?php
+declare(strict_types=1);
+
+namespace WPMultiCity\Tests;
+
+use WPMultiCity\RestUrlFilter;
+
+final class RestUrlFilterTest extends TestCase
+{
+    public function test_register_attaches_rest_url_filter(): void
+    {
+        RestUrlFilter::register();
+
+        self::assertNotFalse(
+            has_filter('rest_url', [RestUrlFilter::class, 'preserve_host']),
+            'RestUrlFilter::register() must hook rest_url'
+        );
+    }
+
+    public function test_preserve_host_replaces_host_when_http_host_set(): void
+    {
+        $_SERVER['HTTP_HOST'] = 'site.com';
+
+        self::assertSame(
+            'https://site.com/wp-json/wp/v2/posts',
+            RestUrlFilter::preserve_host('http://other.example/wp-json/wp/v2/posts')
+        );
+    }
+
+    public function test_preserve_host_returns_url_unchanged_when_http_host_missing(): void
+    {
+        unset($_SERVER['HTTP_HOST']);
+
+        $url = 'https://other.example/wp-json/wp/v2/posts';
+        self::assertSame($url, RestUrlFilter::preserve_host($url));
+    }
+}