seo(htaccess): enable canonical-host 301 to msosorg.com (go-live)

Now that msosorg.com serves the docroot, 301 every non-canonical host
(the temp domain msos.spletnimojster.si, any www., the origin host) to
https://msosorg.com to consolidate ranking signals. Runs before the
HTTPS-force so the temp domain reaches the canonical in a single hop; the
condition excludes msosorg.com itself so there is no redirect loop.

Mark the redirect steps done in the launch checklist.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.htaccess

@@ -1,6 +1,14 @@
 
 RewriteEngine on
 
+# ----- Canonical host -----
+# msosorg.com now serves this docroot, so consolidate ranking signals: 301
+# every other host — the old temp domain msos.spletnimojster.si, any "www.",
+# and the origin host — to the canonical bare apex over HTTPS. Runs before the
+# HTTPS-force below so the temp domain reaches the canonical in a single hop.
+RewriteCond %{HTTP_HOST} !^msosorg\.com$ [NC]
+RewriteRule ^ https://msosorg.com%{REQUEST_URI} [R=301,L]
+
 # ----- Force HTTPS everywhere -----
 # Redirect any plain-http request to https. The two conditions together avoid
 # a redirect loop when TLS is terminated by an upstream proxy (which forwards
@@ -10,12 +18,8 @@ RewriteCond %{HTTP:X-Forwarded-Proto} !=https
 RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
 
 # ----- Language root redirect -----
-# Send the bare root to the default-language homepage, on WHATEVER host is
-# serving the site (relative — no cross-domain redirect). Do NOT force
-# msosorg.com here: the site is currently served from msos.spletnimojster.si,
-# and msosorg.com does not yet serve these files, so forcing it 404s.
-# Once msosorg.com is pointed at this same docroot, a canonical-host redirect
-# can be added back safely.
+# Send the bare root to the default-language homepage. After the canonical-host
+# rule above, this only runs on https://msosorg.com, so it stays relative.
 RewriteRule ^/?$ /en/ [R=301,L]
 
 # ----- Defense-in-depth: block dev/sensitive files if they ever ship -----