seo(htaccess): enable canonical-host 301 to msosorg.com (go-live)

Now that msosorg.com serves the docroot, 301 every non-canonical host
(the temp domain msos.spletnimojster.si, any www., the origin host) to
https://msosorg.com to consolidate ranking signals. Runs before the
HTTPS-force so the temp domain reaches the canonical in a single hop; the
condition excludes msosorg.com itself so there is no redirect loop.

Mark the redirect steps done in the launch checklist.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.htaccess

@@ -1,6 +1,14 @@
 
 RewriteEngine on
 
+# ----- Canonical host -----
+# msosorg.com now serves this docroot, so consolidate ranking signals: 301
+# every other host — the old temp domain msos.spletnimojster.si, any "www.",
+# and the origin host — to the canonical bare apex over HTTPS. Runs before the
+# HTTPS-force below so the temp domain reaches the canonical in a single hop.
+RewriteCond %{HTTP_HOST} !^msosorg\.com$ [NC]
+RewriteRule ^ https://msosorg.com%{REQUEST_URI} [R=301,L]
+
 # ----- Force HTTPS everywhere -----
 # Redirect any plain-http request to https. The two conditions together avoid
 # a redirect loop when TLS is terminated by an upstream proxy (which forwards
@@ -10,12 +18,8 @@ RewriteCond %{HTTP:X-Forwarded-Proto} !=https
 RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
 
 # ----- Language root redirect -----
-# Send the bare root to the default-language homepage, on WHATEVER host is
+# Send the bare root to the default-language homepage. After the canonical-host
-# serving the site (relative — no cross-domain redirect). Do NOT force
+# rule above, this only runs on https://msosorg.com, so it stays relative.
-# msosorg.com here: the site is currently served from msos.spletnimojster.si,
-# and msosorg.com does not yet serve these files, so forcing it 404s.
-# Once msosorg.com is pointed at this same docroot, a canonical-host redirect
-# can be added back safely.
 RewriteRule ^/?$ /en/ [R=301,L]
 
 # ----- Defense-in-depth: block dev/sensitive files if they ever ship -----

docs/launch-seo-checklist.md

@@ -22,18 +22,21 @@ this is the "flip the switch" list.
 - [ ] Confirm a valid **HTTPS certificate** (Let's Encrypt / host-provided).
 - [ ] Confirm the site loads at `https://msosorg.com/en/` (and `/mk/`, `/si/`).
 
-## 2. Redirects (`.htaccess`)
+## 2. Redirects (`.htaccess`)  ✅ done
 
-- [ ] Update the root redirect in `.htaccess` (lines 2–5): change
+- [x] Root redirect (`/` → `/en/`) is host-agnostic, so it needs no domain edit.
-      `msos.spletnimojster.si` → `msosorg.com` so `/` → `/en/` on the real host.
+- [x] **Canonical-host 301 added.** A single rule 301s every non-canonical host
-- [ ] Add a **301 from the temp domain to the final domain** so any links /
+      — the temp domain `msos.spletnimojster.si`, any `www.`, and the origin
-      early indexing on `msos.spletnimojster.si` pass equity to `msosorg.com`:
+      host — to `https://msosorg.com`, consolidating ranking signals. It runs
+      before the HTTPS-force so the temp domain reaches the canonical in one hop:
       ```apache
-      RewriteCond %{HTTP_HOST} ^(www\.)?msos\.spletnimojster\.si$ [NC]
+      RewriteCond %{HTTP_HOST} !^msosorg\.com$ [NC]
-      RewriteRule ^(.*)$ https://msosorg.com/$1 [R=301,L]
+      RewriteRule ^ https://msosorg.com%{REQUEST_URI} [R=301,L]
       ```
-- [ ] Pick ONE host form (www vs non-www) and 301 the other to it.
+- [x] Host form chosen: **bare `msosorg.com`** (matches the hard-coded canonicals);
-- [ ] (Ask me to make these edits — they're quick.)
+      `www.` is folded into the rule above.
+- [ ] After this deploys, verify with `curl -I https://msos.spletnimojster.si/en/`
+      → `301` to `https://msosorg.com/en/`, and that `https://msosorg.com/en/` is `200`.
 
 ## 3. Verify the technical layer resolves on the real domain