Limits on HTTP Redirect URIs for OAuth in Production vs Local Development

Goal: configure an OAuth client so that the same redirect URI value works in a local development environment (using http://localhost:8080/callback) and in a production environment where the provider requires an HTTPS URI that exactly matches the registered value, including any trailing slash or query parameters.

Uncertainty: whether to enforce PKCE for all clients in production to protect against code interception, or to allow confidential clients to continue using only a client secret, which may be necessary for legacy systems that lack PKCE support.

What are the best practices for reconciling the HTTP vs HTTPS redirect URI requirement between local and production deployments without maintaining separate client registrations? Should PKCE be enforced for confidential clients in production, and how can organizations gracefully migrate legacy clients that cannot implement the code_verifier flow?