Redirects plain HTTP to HTTPS when GamendWeb.Tls's :force is on.

A host on this stack binds port 80 itself, so without a redirect every page has a live plain-HTTP twin that a crawler will index — Search Console then reports http:// URLs alongside the real ones.

Why this is a plug and not endpoint config

Phoenix's :force_ssl endpoint option cannot express a runtime setting: Phoenix.Endpoint reads it with Application.compile_env/2 and decides at compile time whether to insert Plug.SSL into the endpoint. Setting it from runtime.exs — which is where every other setting on this stack comes from — writes a key nothing ever reads again, so the redirect silently never happens no matter what GAMEND_TLS_FORCE says.

Plug.SSL itself still does the work; only the decision to call it is ours.

HSTS is left to GamendWeb.Plugs.SecurityHeaders, which already sends it on every HTTPS response — hsts: false here just avoids a duplicate header.

Plugged straight after GamendWeb.Plugs.AcmeChallenge so a Let's Encrypt HTTP-01 renewal is answered before this can redirect it, rather than relying only on the path exclusion below.