Make the HSTS max-age configurable with HSTS_MAX_AGE (closes #271)

HSTS_MAX_AGE, a Go duration, sets the max-age of the
Strict-Transport-Security header. Unset, it is ten years (87600h);
0 sends no header at all. A negative value, or one that is not a
whole number of seconds, stops startup like an unparseable one.
includeSubDomains and preload stay in the header. The value is shown
on /settings and in the startup log, and the README's HSTS section
now says what each part of the header commits the operator to.

Model: opus-5-5

README.md

@@ -911,11 +911,12 @@ as `example.com`, not `hooks.example.com`. A listed domain is HTTPS-only in
 every browser that ships the list, even for users who have never visited it, and
 removal takes months to reach those browsers, so treat a listing as permanent.
 
-Setting `HSTS_MAX_AGE=0` later stops the header being sent, but a browser that
-already received it over HTTPS does not forget it. That browser keeps refusing
-plaintext HTTP until the `max-age` it saw runs out. Only a `max-age=0` header
-received over HTTPS clears it sooner. webhooker never sends one; a reverse proxy
-in front of it can.
+Setting `HSTS_MAX_AGE=0` stops the header being sent, but a browser that already
+received it over HTTPS does not forget it: it keeps refusing plaintext HTTP
+until the `max-age` it saw runs out. Each header a browser receives over HTTPS
+replaces the `max-age` it stored, so to end the policy sooner, set a short
+`HSTS_MAX_AGE` such as `1s` and keep it until returning browsers have picked it
+up, or have a reverse proxy send `max-age=0`.
 
 ## Backup, Restore, and Upgrades