Enforce HTTPS and synchronize history documentation

[Navesz]

Summary

• add a one-year HSTS policy with subdomain coverage and no preload opt-in
• verify the policy at the security helper and rendered response levels
• update history documentation for six tracked signals and backup format v3
• clarify safe migration from v1 and v2 backups

Validation

• npm run lint
• npm test (141 passing)
• npm audit --omit=dev (0 vulnerabilities)