- Redirect all plain-http requests to https (double condition guards against
a redirect loop behind a TLS-terminating proxy).
- Add Strict-Transport-Security (6-month max-age, no preload/includeSubDomains
so it stays easy to adjust) so browsers refuse http after the first visit.
Closes the "HTTPS everywhere" gap: previously http:// served in the clear.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
popovskik