GingerCal 1.4: bundled TLS 1.2, no bridge needed

CalDAV now goes through Minamp's own HTTP/TLS client (Bouncy Castle TLS 1.2, Mozilla
roots, keep-alive) instead of Apache HttpClient on Android 2.3's TLS 1.0, as the iPod
version does with BearSSL. The phone reaches the normal https:// Nextcloud address at
home and away; a pinned self-signed server or the old bridge still works.

- NetHttp transport; requests run on big-stack threads (the handshake overflows
  AsyncTask/IntentService stacks on Android 2.x)
- http:// -> https:// redirects on the same host are followed; other hosts still refused
- bridge wording replaced in Galician and English; README updated
- NetTest (TLS + CalDAV discovery through the new transport) replaces BridgeTest

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

android/org/gingercal/App.java

@@ -67,7 +67,7 @@ public final class App {
     }
 
     public static Dav dav(String url, String user, String pass, String pin) throws Exception {
-        return new Dav(new ApacheHttp(pin, 30000), url, user, pass);
+        return new Dav(new NetHttp(pin, 30000), url, user, pass);
     }
 
     public static boolean online(Context c) {
@@ -126,9 +126,9 @@ public final class App {
         if (t instanceof UnknownHostException) {
             return L.f("Can't resolve %s. No connection, or a typo in the server address.", t.getMessage());
         }
-        if (t instanceof ConnectException) return L.f("Can't connect to the server (%s). Wrong port, or the bridge is down?", t.getMessage());
+        if (t instanceof ConnectException) return L.f("Can't connect to the server (%s). Wrong address or port, or the server is down?", t.getMessage());
         if (t instanceof SocketTimeoutException) return L.t("The server took too long to answer.");
-        if (t instanceof SSLException) return L.f("TLS error: %s", t.getMessage());
+        if (t instanceof SSLException || t instanceof com.minamp.bc.tls.TlsException) return L.f("TLS error: %s", t.getMessage());
         if (t instanceof IOException) return L.f("Network error: %s", t);
         if (t instanceof OutOfMemoryError) return L.t("Out of memory. Lower 'Days ahead' in Settings.");
         return L.f("Error: %s", t);
@@ -144,8 +144,8 @@ public final class App {
 
     public static void askTrust(Activity a, final DavException.UntrustedCert u, final Trusted cb) {
         String msg = (u.pinMismatch
-                ? L.t("WARNING: the server certificate changed since you trusted it. That happens when you regenerate the bridge certificate - or when someone is intercepting the connection.\n\n")
-                : L.t("This phone doesn't trust the server certificate (normal for the self-signed legacy bridge, or for Let's Encrypt on Android 2.3).\n\n"))
+                ? L.t("WARNING: the server certificate changed since you trusted it. That happens when a self-signed certificate is regenerated - or when someone is intercepting the connection.\n\n")
+                : L.t("The server certificate isn't signed by a known authority (normal for a self-signed server or an old TLS 1.0 bridge).\n\n"))
                 + L.f("Subject: %s\nIssuer: %s\nExpires: %s\n\nSHA-256:\n%s\n\nOnly trust it if this matches the fingerprint printed on your server.",
                 u.subject, u.issuer, u.expires, u.fingerprint);
         new AlertDialog.Builder(a)