Make the HSTS max-age configurable with HSTS_MAX_AGE (closes #271)

HSTS_MAX_AGE, a Go duration, sets the max-age of the
Strict-Transport-Security header. Unset, it is ten years (87600h);
0 sends no header at all. A negative value, or one that is not a
whole number of seconds, stops startup like an unparseable one.
includeSubDomains and preload stay in the header. The value is shown
on /settings and in the startup log, and the README's HSTS section
now says what each part of the header commits the operator to.

Model: opus-5-5

internal/handlers/settings.go

@@ -86,6 +86,13 @@ func settingRows(cfg *config.Config) []settingRow {
 			"Idle session timeout (Go duration)",
 			cfg.SessionIdleTimeout.String(),
 		},
+		{
+			"HSTS_MAX_AGE",
+			"max-age of the Strict-Transport-Security header, which " +
+				"also carries includeSubDomains and preload (Go " +
+				"duration, whole seconds). 0 sends no header",
+			cfg.HSTSMaxAge.String(),
+		},
 		{
 			"RECEIVER_RATE_LIMIT",
 			"Receiver requests/minute per IP per entrypoint " +

internal/handlers/settings_test.go

@@ -76,6 +76,7 @@ func TestSettingsPageShowsLoadedConfiguration(t *testing.T) {
 		BindAddress:            "192.0.2.10",
 		RetentionSweepInterval: 17 * time.Minute,
 		SessionIdleTimeout:     3 * time.Hour,
+		HSTSMaxAge:             8760 * time.Hour,
 		ReceiverRateLimit:      77,
 		TrustedProxies: []netip.Prefix{
 			netip.MustParsePrefix("10.1.0.0/16"),
@@ -99,6 +100,7 @@ func TestSettingsPageShowsLoadedConfiguration(t *testing.T) {
 		"SENTRY_DSN":               "not set",
 		"RETENTION_SWEEP_INTERVAL": "17m0s",
 		"SESSION_IDLE_TIMEOUT":     "3h0m0s",
+		"HSTS_MAX_AGE":             "8760h0m0s",
 		"RECEIVER_RATE_LIMIT":      "77",
 		"TRUSTED_PROXIES":          "10.1.0.0/16",
 		"ALLOWED_EGRESS_CIDRS":     "192.168.5.0/24, fd00::/8",