chore: emphasize role of '-i' server cli flag

horde/argparser.py

@@ -11,7 +11,13 @@ arg_parser.add_argument(
     "-i",
     "--insecure",
     action="store_true",
-    help="If set, will use http instead of https (useful for testing)",
+    help=(
+        "Serve over HTTP instead of HTTPS. Sets OAUTHLIB_INSECURE_TRANSPORT=1 "
+        "so oauthlib tolerates http:// redirect URIs. "
+        "WARNING: OAuth providers (Google, Discord, GitHub) will reject "
+        "http:// callbacks unless they are explicitly configured to accept them "
+        "(redirect_uri_mismatch). This breaks production registrations."
+    ),
 )
 arg_parser.add_argument(
     "-v",

server.py

@@ -82,9 +82,17 @@ if __name__ == "__main__":
     logger.init("WSGI Server", status="Starting")
     url_scheme = "https"
     if args.insecure:
-        os.environ["OAUTHLIB_INSECURE_TRANSPORT"] = "1"  # Disable this on prod
+        os.environ["OAUTHLIB_INSECURE_TRANSPORT"] = "1"
         url_scheme = "http"
         logger.init_warn("WSGI Mode", status="Insecure")
+        logger.warning(
+            "INSECURE MODE (-i/--insecure): Serving over HTTP. "
+            "OAuth redirect URIs will use http:// instead of https://. "
+            "This causes redirect_uri_mismatch errors with OAuth providers "
+            "(Google, Discord, GitHub) unless each provider's developer "
+            "console explicitly allows http:// callbacks. "
+            "This flag MUST NOT be used in production."
+        )
 
     waitress.serve(
         app,