HSTS is a one-way door

I added Strict-Transport-Security: max-age=31536000. Days later, trying to debug over HTTP, the browser jumped to https and refused to continue.

That is the design: the domain may only be reached over HTTPS for max-age, and certificate errors cannot be bypassed. The only exits are clearing the browser's HSTS list (chrome://net-internals/#hsts) or waiting.

So do not start with a year. Use max-age=300, watch for a few days, confirm every subdomain has a certificate, then lengthen. includeSubDomains is riskier still: one subdomain without a cert becomes unreachable.

The header only counts on HTTPS responses; on HTTP it is ignored.