v0.312.0: every public name answers only over https; HSTS one day (R-1033, P1)

forwarded.yml: felhom-forwarded is now a chain [felhom-https-only (redirectScheme https, 301 when the trusted tunnel
says X-Forwarded-Proto: http), felhom-forwarded-headers (the clean-up + HSTS 86400, no subdomains, no preload)] plus a
priority-1 catch-all router for unknown names over http. traefik.yml unchanged; hot-loaded.
Tests red-proofed. Evidence: felhom.eu documentation/audits/https-only-2026-10-14/.

CHANGELOG.md

@@ -1,3 +1,24 @@
+## v0.312.0 — every public name answers only over https; HSTS one day (R-1033, P1) (2026-10-14)
+
+**MinAgent: 0.155.0** (unchanged — traefik's dynamic file only). **Hub:** none. **Catalog:** none. Design: felhom.eu
+`09` §3 decision 244 (the operator made R-1033 P1) and the decision taken unattended that night (traefik, not
+Cloudflare: the box keys lack „Zone Settings"); evidence felhom.eu `documentation/audits/https-only-2026-10-14/`.
+
+- **`dynamic/forwarded.yml` (`infra.RenderForwardedHeaders`):** `felhom-forwarded`, the middleware traefik's websecure
+  entrypoint already names, is now a CHAIN — `felhom-https-only` (redirectScheme https, permanent) then
+  `felhom-forwarded-headers` (the unchanged header clean-up + `Strict-Transport-Security: max-age=86400`, no subdomains,
+  no preload). A visitor who typed `http://` reaches Cloudflare over plain http; the tunnel delivers to :443 and says
+  so in `X-Forwarded-Proto: http`, which traefik keeps only from the trusted tunnel address — so the visitor gets a 301
+  to the same https URL (path and query kept) BEFORE any app sees the request. An https visitor and a LAN visitor are
+  unchanged; a forged `X-Forwarded-Proto` from any other peer is ignored. Measured with traefik v3.7.13 on the bench.
+- **`felhom-https-only-catchall`** (router, priority 1, `Header(X-Forwarded-Proto, http)`, `noop@internal`): a name no
+  app route matches is redirected over http too, while the same unknown name over https stays traefik's 404.
+- traefik.yml is UNCHANGED (the entrypoint still names `felhom-forwarded@file`): the dynamic file is hot-loaded, no
+  traefik restart. The existing bring-up rewrites a drifted file on the next health tick (`ensureForwardedHeaders`).
+- Tests: `TestRenderForwardedHeaders_HTTPSOnly` (red-proofed: the redirect removed from the chain → fails; HSTS a year →
+  fails), `TestEnsureForwardedHeaders_R1033_RewritesAnOldFile` (red-proofed: rewrite only when missing → fails);
+  `TestRenderForwardedHeaders_RemovesClientWritableHeaders` reads the headers through the chain.
+
 ## v0.311.0 — after a power cut, an app repairs the files the cut left empty; the household sees lost photos (R-1007) (2026-10-14)
 
 **MinAgent: 0.155.0** (unchanged — the crash fact is the existing `GET /host/crash-guard`). **Hub:** v0.150.0 registers