controller (unreleased): HSTS is one year (R-1050, decision 249)

One day since 2026-10-15; no https trouble found in the registers, the operator's mailbox or the hub's log. Still no
includeSubDomains, no preload. The release must be built on or after 2026-11-15.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/infra/infra.go

@@ -103,9 +103,12 @@ const (
 	ForwardedHeadersMiddleware = "felhom-forwarded-headers"
 	HTTPSOnlyMiddleware        = "felhom-https-only"
 	HTTPSOnlyCatchAllRouter    = "felhom-https-only-catchall"
-	// HSTSMaxAgeSeconds is ONE DAY on purpose (decision 244 brief): no includeSubDomains, no preload — a longer value is
-	// the operator's decision (register row), because a browser keeps it even if the box is ever served without https.
-	HSTSMaxAgeSeconds = 86400
+	// HSTSMaxAgeSeconds is ONE YEAR (felhom.eu `09` §3 decision 249, D2 = A, R-1050): it was one day from 2026-10-15,
+	// and becomes one year after a month with no https trouble (searched 2026-11-14: the open and closed registers,
+	// the operator's mailbox, the hub's log — none). NEVER includeSubDomains, NEVER preload: a browser keeps this value
+	// for the whole year even if a name is ever served without https, and those two cannot be taken back.
+	// Pinned by TestRenderForwardedHeaders_HTTPSOnly.
+	HSTSMaxAgeSeconds = 31536000
 )
 
 // TraefikData is the per-customer input for the traefik stack. ACMEEmail empty → no Let's Encrypt

controller/internal/infra/tunnel_test.go

@@ -164,8 +164,9 @@ func TestRenderForwardedHeaders_HTTPSOnly(t *testing.T) {
 		t.Errorf("%s must be redirectScheme{scheme: https, permanent: true}, got %v", HTTPSOnlyMiddleware, mws[HTTPSOnlyMiddleware])
 	}
 	h := mws[ForwardedHeadersMiddleware].(map[string]any)["headers"].(map[string]any)
-	if h["stsSeconds"] != HSTSMaxAgeSeconds || HSTSMaxAgeSeconds != 86400 {
-		t.Errorf("HSTS must be one day (86400) until the operator rules otherwise, got %v", h["stsSeconds"])
+	// R-1050 (decision 249): one year since the release after 2026-11-15; it was one day (86400) for the first month.
+	if h["stsSeconds"] != HSTSMaxAgeSeconds || HSTSMaxAgeSeconds != 31536000 {
+		t.Errorf("HSTS must be one year (31536000) — decision 249 — got %v (constant %d)", h["stsSeconds"], HSTSMaxAgeSeconds)
 	}
 	if h["stsIncludeSubdomains"] != false || h["stsPreload"] != false {
 		t.Errorf("HSTS must not include subdomains nor preload, got %v / %v", h["stsIncludeSubdomains"], h["stsPreload"])