v0.312.0: every public name answers only over https; HSTS one day (R-1033, P1)

forwarded.yml: felhom-forwarded is now a chain [felhom-https-only (redirectScheme https, 301 when the trusted tunnel
says X-Forwarded-Proto: http), felhom-forwarded-headers (the clean-up + HSTS 86400, no subdomains, no preload)] plus a
priority-1 catch-all router for unknown names over http. traefik.yml unchanged; hot-loaded.
Tests red-proofed. Evidence: felhom.eu documentation/audits/https-only-2026-10-14/.

REPORT.md

@@ -1,15 +1,11 @@
-# REPORT — v0.311.0: after a power cut, an app repairs the files the cut left empty (R-1007, 2026-10-14)
+# REPORT — v0.312.0: every public name answers only over https (R-1033, P1, 2026-10-14 night)
 
-Baseline `acbbf4b` (0.310.0). Code `8d862e4`, security fix `3b85a0c` (before the build). Image
-`felhom-controller:0.311.0` (sha256 `2a5550da…`). Design: felhom.eu `09` §3 decision 236; evidence
-felhom.eu `documentation/audits/immich-repair-2026-10-14/`.
+Baseline `9b95e8e` (0.311.0). Design: felhom.eu `09` §3 decision 244 + the unattended decision recorded there (traefik on
+the box, because the box keys cannot change Cloudflare zone settings). Evidence: felhom.eu
+`documentation/audits/https-only-2026-10-14/`.
 
-- New template block `after_unclean_boot`; `internal/aftercrash` runs it once per start after an UNCLEAN host boot
-  (crashboot's verdict, after the 15-min crash grace). The household's lost-files note on the app page; the operator
-  event `app_repaired_after_crash` (counts only). MinAgent 0.155.0 unchanged.
-- Tests: 15 guards red-proofed (each removed in turn convicted its test). Full suite and every controller gate green.
-- **Security review of `8d862e4`:** compose's shared runner logs a failed command's stdout and puts stderr in the error,
-  which reached the event's `problem`. Fixed: a quiet runner, exit code only (`TestAUB_AFailingCommandLeaksNoOutput`).
-- **Live (demo-hp 9201, a real power cut mid-upload):** 41 of 41 broken photos repaired in 10 s; 120 controls untouched.
-- Open: R-1020 — the returned duration is 0 (the record's is right). Delivery to the N100 and Tester 1 waits on golden
-  0.311.0 + the global floor.
+- `forwarded.yml`: `felhom-forwarded` = chain [`felhom-https-only` (redirectScheme https, 301), `felhom-forwarded-headers`
+  (clean-up + HSTS 86400)]; catch-all router for unknown names over http. traefik.yml unchanged, no traefik restart.
+- Tests red-proofed (three mutations, each seen failing). Green gate: build, vet, test all OK.
+- Delivered by hand to Tester 1, demo-hp 9201 and demo-felhom 9201 for the proof (Tier 0). **Not vouched, floor not
+  moved** — the operator's morning step.