[jpol34]

Summary

• Browsers resolve a bare hostname to http://, so with nothing on port 80 the natural thing to type gives ERR_CONNECTION_REFUSED while the server sits on 443.
• Adds a redirect-only listener on port 80 when serving HTTPS at the default port (443) - gated on actually attempting the bind (not just probing for an existing listener), since a bind failure inside Start-PodeServer is fatal to the whole server.
• Falls back with an explanatory warning when port 80 isn't bindable (already in use, or privileged and unelevated). Skipped entirely when an explicit -Port is passed, since claiming port 80 too would be a surprising side effect of an unrelated choice.
• The redirect target is derived from the request's Host header (so the cert always matches the address bar), with a guard against reflecting an unrecognized host into Location (open-redirect protection).
• README updated with a brief note on the new behavior.

Test plan

• Started the real server (existing trusted strongbox.local cert + hosts entry on this machine) and confirmed live:
  • http://strongbox.local -> 302 to https://strongbox.local/
  • https://strongbox.local still responds 200
  • A spoofed Host: evil.example.com header falls back to the configured hostname instead of being reflected into Location
• Invoke-Pester -Path Tests/Strongbox.Tests.ps1 - 43 passed, 0 failed (no dedicated coverage plan for this script, matching the existing gap for ui/Start-StrongboxUi.ps1 and the sync server).