Enforce strict transport security config

When documenting or implementing security-related configuration (host validation, HTTPS/HSTS, CSP), state requirements as mandatory actions, not optional suggestions, and ensure the guidance is technically correct per the relevant spec.

For external URL generation, Flask trusts the request’s Host header by default, which can enable host header injection (e.g., in password reset links). Always require setting SERVER_NAME and/or trusted_hosts in production rather than merely suggesting it:

Set ``SERVER_NAME`` in your configuration for production deployments, and
use ``trusted_hosts`` to restrict which hosts are accepted. Do not rely on
the request's ``Host`` header without this configuration when using
``url_for(..., _external=True)``.

Similarly, when specifying security headers like HSTS, follow the spec exactly—e.g., the preload directive is only valid when combined with includeSubDomains:

Strict-Transport-Security: max-age=<expire-time>; includeSubDomains; preload

Review any security-related configuration or documentation for both correctness (matching the actual spec/behavior) and firmness (mandating safe defaults instead of leaving them as optional recommendations).</description> </invoke>