Your router is running Linux, and this behaviour is easy to implement on any stock Linux distro. I can guess what rules must be present in your router's firewall for it to work like this. But be aware this is only a speculation, we don't know how exactly rules look in reality.
When you forwarded a port to your webserver, it added a specific DNAT rule, which likely looks like this:
iptables -t nat -A PREROUTING -p tcp -d <your-external-address> --dport 443 -j DNAT --to-destination <raspberry-pi-address>
In words, this means: "before deciding whether this packet is destined to the device or must be forwarded, check if the packet destination address is your external address and destination port is 443. If it matches, change destination address to the raspberry pi's LAN address". Notice, this rule doesn't filter by the interface.
Also it definitely has the SNAT-type rule (for providing an access to the internet for the LAN), probably it looks like this:
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j MASQUERADE
In other words, after the router decides where the packet must go, before sending packet, it changes its source address to the whichever address an outbound interface has (if the packet was sent from the LAN). Again, nothing is filtered by an interface.
Now consider your HTTPS connection. You are specifying the host name in the browser, right? You set it up so it is resolved to your router's external address, which becomes the destination address. Your source address is inside LAN. So, it seems both of these rules apply to packets of your connection.
Processing them, router first encounters DNAT rule, checks the destination address and port and decides to change destination address to raspberry pi's one. Then it finds out the interface the packet must go out is LAN one. Then it checks partially translated packet against second rule, and finds out the source address is from LAN. So it replaces source address of the packet with the address of LAN interface, 192.168.1.1. This is what your raspberry pi sees.
The NAT operation is stateful, i.e. it also maintains a table record which says which was replaced with what and how to detect subsequent forward and reply packets, so it translates all of them correctly. Yes, it turns out Linux can do DNAT and SNAT at the same time within the same stream.
Can you trust this behaviour? I don't know. If the router's firmware was open source, we had a chance to check. Without source, we can't be sure. This is always the case when the source is closed, that's why closed source products must be avoided if you are concerned about security.
