fix: force $_SERVER['HTTPS'] when APP_URL uses HTTPS

Completes the fix for #290. Setting WP_HOME from config('app.url') was
not sufficient — WordPress also checks $_SERVER['HTTPS'] for canonical
URL redirects. Behind a reverse proxy, this variable is 'off' unless
explicitly set, causing redirect loops.

Instead of trusting proxy headers (removed in b98bfef for security),
we derive the HTTPS state from the declarative APP_URL configuration.

Author: ogorzalka

src/WordPress/WordPressServiceProvider.php

@@ -84,6 +84,7 @@ private function handleHttpsProtocol(): void
     {
         if (is_secured()) {
             URL::forceScheme('https');
+            $_SERVER['HTTPS'] = 'on';
         }
     }
 }