HSTS missing max-age
Strict-Transport-Security is present but has no max-age directive, so browsers ignore it as HSTS.
Why it matters
Without max-age the header does not create an HTTPS-only rule.
What to do
Add max-age=31536000.
Reference
HSTS max-age and directive syntax are defined by RFC 6797.