- Enforce HTTPS for podcast audio files in serializers and admin field
- Add cache-busting version query param to bypass Cloudflare 301 cached redirect
- Configure SECURE_PROXY_SSL_HEADER and USE_X_FORWARDED_HOST/PORT in settings
- Update nginx config with HTTP to HTTPS redirect, media range/CORS headers and X-Forwarded-Proto handling