HSTS disabled via max-age=0
Strict-Transport-Security is present with max-age=0, which tells browsers to forget HSTS for this host.
Why it matters
A zero max-age removes the HTTPS-only rule, including one that may already be cached.
What to do
Remove max-age=0 and set max-age to at least 31536000 once HTTPS is reliable.
Reference
HSTS max-age and directive syntax are defined by RFC 6797.