GingerCal 1.4: bundled TLS 1.2, no bridge needed

CalDAV now goes through Minamp's own HTTP/TLS client (Bouncy Castle TLS 1.2, Mozilla
roots, keep-alive) instead of Apache HttpClient on Android 2.3's TLS 1.0, as the iPod
version does with BearSSL. The phone reaches the normal https:// Nextcloud address at
home and away; a pinned self-signed server or the old bridge still works.

- NetHttp transport; requests run on big-stack threads (the handshake overflows
  AsyncTask/IntentService stacks on Android 2.x)
- http:// -> https:// redirects on the same host are followed; other hosts still refused
- bridge wording replaced in Galician and English; README updated
- NetTest (TLS + CalDAV discovery through the new transport) replaces BridgeTest

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -3,6 +3,11 @@
 A small native calendar client for Gingerbread (API 9/10). Built for a Samsung Galaxy Mini
 (GT-S5570, 240×320, Android 2.3.5) talking to Nextcloud, reached through Pangolin.
 
+**Since 1.4 it brings its own TLS 1.2** (Bouncy Castle, the same client as Minamp, with Mozilla's
+root certificates and keep-alive connections), like the iPod version does with BearSSL. Put the
+normal `https://` Nextcloud address in Settings, at home or away: no bridge is needed. The bridge
+sections below are kept for reference; a bridge address (pinned certificate) still works.
+
 **What it does**
 
 - Month view: a 6-week grid with a coloured mark per event (calendar colour), today outlined,
@@ -19,11 +24,12 @@ A small native calendar client for Gingerbread (API 9/10). Built for a Samsung G
   they can be deleted on the phone but edited only in Nextcloud
 - Pick which calendars to show and which one new events go to
 - Background sync every 1–24 h, plus phone notifications N minutes before timed events
-- Certificate pinning, so a self-signed "legacy" endpoint is still safe against interception
+- Its own TLS 1.2 stack: connects to modern `https://` servers directly
+- Certificate pinning, so a self-signed server (or the old legacy-TLS bridge) is still safe against interception
 
 It does not feed the stock Samsung calendar: 2.3 has no public calendar-provider API for that.
 
-## Why HTTPS breaks on 2.3, and the fix
+## Why HTTPS broke on 2.3, and the old fix (not needed since 1.4)
 
 Three separate problems, all fatal for a normal Pangolin/Traefik URL:
 
@@ -161,7 +167,9 @@ Tests (desktop JVM, need a CalDAV server such as Radicale on :5232 with user `xo
 ```sh
 javac -d out src/org/gingercal/*.java test/org/gingercal/*.java
 java -cp out org.gingercal.CoreTest          # discovery, sync, recurrence, create/edit/delete
-java -cp out org.gingercal.RedirectTest      # forced-HTTPS / redirect-loop handling (no server needed)
+java -cp out org.gingercal.RedirectTest      # redirect handling (no server needed)
+# the bundled TLS transport (needs the android.jar and Bouncy Castle sources to compile):
+#   java -cp out org.gingercal.NetTest assets/roots http://127.0.0.1:5232 xose secret
 java -cp out org.gingercal.I18nTest          # Galician dates, titles and messages
 ```
 
@@ -172,7 +180,8 @@ declarations.
 ## Layout
 
 - `src/` CalDAV core, platform-neutral: discovery, PROPFIND/REPORT, iCalendar, sync, pinning
-- `android/` activities, sync service, alarms, SQLite cache, Apache HttpClient transport
+- `android/` activities, sync service, alarms, SQLite cache, `NetHttp` transport
+- `android/org/gingercal/net/` the bundled TLS 1.2 HTTP client from Minamp; `assets/roots/` Mozilla roots
 - `stubs/` compile-only Android API 10 signatures (never packaged)
 - `bridge/` legacy-TLS endpoint: standalone nginx (config, compose file), `npm/http.conf` for
   Nginx Proxy Manager, certificate script
@@ -181,6 +190,9 @@ declarations.
 
 ## Security notes
 
+With the bundled TLS 1.2 the connection to Nextcloud is checked like a browser would: host name,
+dates, and a chain up to a Mozilla root. The notes below are about the old bridge.
+
 TLS 1.0 with AES-CBC is old but, combined with a pinned certificate, still keeps the connection
 private and authenticated against anyone without the bridge's private key. The bridge exposes
 only the DAV endpoint. Use an app password so you can revoke the phone from Nextcloud. If the