Make the HSTS max-age configurable with HSTS_MAX_AGE (closes #271)

HSTS_MAX_AGE, a Go duration, sets the max-age of the
Strict-Transport-Security header. Unset, it is ten years (87600h);
0 sends no header at all. A negative value, or one that is not a
whole number of seconds, stops startup like an unparseable one.
includeSubDomains and preload stay in the header. The value is shown
on /settings and in the startup log, and the README's HSTS section
now says what each part of the header commits the operator to.

Model: opus-5-5

internal/handlers/settings.go

@@ -86,6 +86,13 @@ func settingRows(cfg *config.Config) []settingRow {
 			"Idle session timeout (Go duration)",
 			cfg.SessionIdleTimeout.String(),
 		},
+		{
+			"HSTS_MAX_AGE",
+			"max-age of the Strict-Transport-Security header, which " +
+				"also carries includeSubDomains and preload (Go " +
+				"duration, whole seconds). 0 sends no header",
+			cfg.HSTSMaxAge.String(),
+		},
 		{
 			"RECEIVER_RATE_LIMIT",
 			"Receiver requests/minute per IP per entrypoint " +