I noticed the Site URL in the Node banner was "http://" rather than "https://" so I manually updated the Site_Url in rocketchat_settings (in Mongo) and restarted RC.
Now it works.
I'm left to ponder: was it always missing the "s?" If so, why did it work until I upgraded? If not, why did it change? rocketchat.service has always set ROOT_URL to https...