Allow disabling HSTS (HTTP Strict Transport Security) headers via
DISABLE_HSTS=true environment variable. This is useful for local
development when running production builds on localhost/HTTP.
When DISABLE_HSTS=true, the Strict-Transport-Security header is not
sent, preventing browsers from forcing HTTPS connections that would
fail on local HTTP-only setups.
Production deployments should not set this variable to maintain
proper HSTS security.
40295e02a7