Control panel switches to HTTPS protocol on its own
It turned out not to be Craft's fault, indeed: 

On the server, the HTTP_X_FORWARDED_PROTO environment variable was erroneously set to https in the reverse proxy – an issue that my hosting provider had to resolve.

(As a quick fix, the following line in index.php did the trick, too:)

 apache_setenv('HTTP_X_FORWARDED_PROTO', 'http');


Thanks to @brad-bell and @ritterknight for pointing in the right direction!