Force HTTPS from the admin, with a probe before and after

System > HTTPS and cms:https switch the redirect lines in public/.htaccess
only when the site answers over HTTPS, and take them back on a loop. HSTS
is a separate second switch. The redirect block moves before the front
controller rules, where it never reached pages, and .well-known is no
longer denied, so the origin probe works on Apache. The Git updater keeps
switched-on lines like the archive update.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

config/services.yaml

@@ -90,6 +90,14 @@ services:
         arguments:
             $secret: '%kernel.secret%'
             $download: null
+    # HTTPS erzwingen und HSTS (ADR 120); die Probe ueber http kommt im Test als Closure herein.
+    App\Ops\HttpsRedirect:
+        arguments:
+            $projectDir: '%kernel.project_dir%'
+            $httpProbe: null
+    App\Command\HttpsCommand:
+        arguments:
+            $siteOrigin: '%env(SITE_ORIGIN)%'
     App\Command\SiteOriginCommand:
         arguments:
             $projectDir: '%kernel.project_dir%'