bingo: send HSTS

The edge already redirects http:// to https://, but without HSTS the
first request of every visit can still go out in the clear. Turn on
Rack::Protection's StrictTransport for the bingo app: one year, this
host only, no preload.

Assisted-by: Claude:opus-5

bingo_web.rb

@@ -12,6 +12,8 @@ class BingoWeb < Sinatra::Base
     # the card needs none of it.
     set :static, false
     set :show_exceptions, $env == 'development'
+    # HSTS (1 year, this host only); http:// already 308s at the edge.
+    set :protection, use: %i[strict_transport]
     set :host_authorization,
         { permitted_hosts: $env == 'production' ? HOSTS : [] }
   end