Add HSTS to production documentation responses

[yhay81]

Outcome

Serve an explicit HTTP Strict Transport Security policy from every production
documentation asset so returning clients cannot be downgraded to HTTP.

The dedicated HTTP Worker already redirects to HTTPS, but the HTTPS static
asset responses do not currently include Strict-Transport-Security.

Acceptance criteria

• Generate Strict-Transport-Security: max-age=31536000; includeSubDomains
  in the Cloudflare Static Assets _headers file.
• Regression-test the exact directive alongside the existing CSP,
  nosniff, frame, cross-origin, referrer, and permissions policies.
• Pass the strict Zensical build, generated-site validation, dependency
  audit, workflow audit, and external-link checks.
• Deploy from the exact reviewed main commit.
• Verify HSTS on both the custom domain and Workers.dev fallback while
  preserving the HTTP-to-HTTPS redirect.

Boundary

Do not add the preload directive or submit the domain to the browser preload
list in this change. That is a longer-lived operational commitment and should
remain a separate explicit decision.

[yhay81]

Completed through PR #11 at main commit
a18f4c0193106222972cdc5f41dca0f728155fe3.

• main build, live PyPI freshness, external links, dependency audit, and workflow audit: https://github.com/hayatepy/docs/actions/runs/30499384900
• static site Worker version: 8c4a6b86-7380-4ca0-8b9d-d55ae4f1c70c
• redirect Worker version: a0934668-7339-4ce5-b218-cff4e0b50bb4
• https://hayatepy.dev/ and the Workers.dev fallback both return the exact
  Strict-Transport-Security: max-age=31536000; includeSubDomains directive
• http://hayatepy.dev/* continues to return a 301 redirect to HTTPS

The deployed policy deliberately omits preload, preserving the stated
operational boundary.