security: add HSTS to documentation assets

[yhay81]

Closes #10.

Summary

• generate Strict-Transport-Security: max-age=31536000; includeSubDomains for every Cloudflare Static Assets response
• regression-test the exact one-year policy alongside the existing CSP and browser security headers
• deliberately omit preload, which remains a separate long-lived operational decision

Why

The HTTP-only Worker redirects requests to HTTPS, but production HTTPS
responses did not instruct returning browsers to refuse future plaintext
connections. That made the site's “strict security headers” evidence
incomplete.

Validation

• Ruff lint and format
• 15 tests
• live PyPI freshness and generated ecosystem drift check
• Zensical strict build
• generated header exact-match and site validation
• pip-audit: no known vulnerabilities
• zizmor 1.28.0: no findings
• git diff --check