seo(htaccess): enable canonical-host 301 to msosorg.com (go-live)

Now that msosorg.com serves the docroot, 301 every non-canonical host
(the temp domain msos.spletnimojster.si, any www., the origin host) to
https://msosorg.com to consolidate ranking signals. Runs before the
HTTPS-force so the temp domain reaches the canonical in a single hop; the
condition excludes msosorg.com itself so there is no redirect loop.

Mark the redirect steps done in the launch checklist.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/launch-seo-checklist.md

@@ -22,18 +22,21 @@ this is the "flip the switch" list.
 - [ ] Confirm a valid **HTTPS certificate** (Let's Encrypt / host-provided).
 - [ ] Confirm the site loads at `https://msosorg.com/en/` (and `/mk/`, `/si/`).
 
-## 2. Redirects (`.htaccess`)
+## 2. Redirects (`.htaccess`)  ✅ done
 
-- [ ] Update the root redirect in `.htaccess` (lines 2–5): change
-      `msos.spletnimojster.si` → `msosorg.com` so `/` → `/en/` on the real host.
-- [ ] Add a **301 from the temp domain to the final domain** so any links /
-      early indexing on `msos.spletnimojster.si` pass equity to `msosorg.com`:
+- [x] Root redirect (`/` → `/en/`) is host-agnostic, so it needs no domain edit.
+- [x] **Canonical-host 301 added.** A single rule 301s every non-canonical host
+      — the temp domain `msos.spletnimojster.si`, any `www.`, and the origin
+      host — to `https://msosorg.com`, consolidating ranking signals. It runs
+      before the HTTPS-force so the temp domain reaches the canonical in one hop:
       ```apache
-      RewriteCond %{HTTP_HOST} ^(www\.)?msos\.spletnimojster\.si$ [NC]
-      RewriteRule ^(.*)$ https://msosorg.com/$1 [R=301,L]
+      RewriteCond %{HTTP_HOST} !^msosorg\.com$ [NC]
+      RewriteRule ^ https://msosorg.com%{REQUEST_URI} [R=301,L]
       ```
-- [ ] Pick ONE host form (www vs non-www) and 301 the other to it.
-- [ ] (Ask me to make these edits — they're quick.)
+- [x] Host form chosen: **bare `msosorg.com`** (matches the hard-coded canonicals);
+      `www.` is folded into the rule above.
+- [ ] After this deploys, verify with `curl -I https://msos.spletnimojster.si/en/`
+      → `301` to `https://msosorg.com/en/`, and that `https://msosorg.com/en/` is `200`.
 
 ## 3. Verify the technical layer resolves on the real domain