Hello! It took a while, but finally hydra.gnu.org has its own Let’s Encrypt certificate and is available over https, woohoo!
Back to the initial problem, we (i.e., you ;-)) can now modify packages.js so that it uses either http or https to use Hydra’s API, depending on the current URL. Thoughts? Ludo’.