Add HSTS enforcement check (#163)

[jthack]

Summary

• ensure HTTPS responses expose a Strict-Transport-Security header
• flag missing headers, weak max-age values, and absent includeSubDomains
• register the passive check and enable it in the Balanced preset

Testing

• pnpm lint
• pnpm typecheck
• pnpm test -- --match 'HSTS not enforced'

Closes #163