bingo: send HSTS

The edge already redirects http:// to https://, but without HSTS the
first request of every visit can still go out in the clear. Turn on
Rack::Protection's StrictTransport for the bingo app: one year, this
host only, no preload.

Assisted-by: Claude:opus-5

bingo_web.rb

@@ -12,6 +12,8 @@ class BingoWeb < Sinatra::Base
     # the card needs none of it.
     set :static, false
     set :show_exceptions, $env == 'development'
+    # HSTS (1 year, this host only); http:// already 308s at the edge.
+    set :protection, use: %i[strict_transport]
     set :host_authorization,
         { permitted_hosts: $env == 'production' ? HOSTS : [] }
   end

test/bingo_test.rb

@@ -216,6 +216,12 @@ class BingoTest < Minitest::Test
     assert_includes last_response.body, '<link rel="icon" href="/favicon.svg" type="image/svg+xml">'
   end
 
+  def test_hsts
+    get '/en'
+    assert_equal 'max-age=31536000', last_response.headers['strict-transport-security']
+    assert_equal 'nosniff', last_response.headers['x-content-type-options']
+  end
+
   def test_root_varies_on_language
     get '/'
     assert_equal 'Accept-Language', last_response.headers['Vary']