GingerCal 1.4: bundled TLS 1.2, no bridge needed

CalDAV now goes through Minamp's own HTTP/TLS client (Bouncy Castle TLS 1.2, Mozilla
roots, keep-alive) instead of Apache HttpClient on Android 2.3's TLS 1.0, as the iPod
version does with BearSSL. The phone reaches the normal https:// Nextcloud address at
home and away; a pinned self-signed server or the old bridge still works.

- NetHttp transport; requests run on big-stack threads (the handshake overflows
  AsyncTask/IntentService stacks on Android 2.x)
- http:// -> https:// redirects on the same host are followed; other hosts still refused
- bridge wording replaced in Galician and English; README updated
- NetTest (TLS + CalDAV discovery through the new transport) replaces BridgeTest

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

android/org/gingercal/GingerApp.java

@@ -2,11 +2,20 @@ package org.gingercal;
 
 import android.app.Application;
 
-/** Runs before any screen, service or alarm: sets the interface language (Galician by default). */
+/** Runs before any screen, service or alarm: interface language (Galician by default), bundled TLS. */
 public class GingerApp extends Application {
     @Override
     public void onCreate() {
         super.onCreate();
         L.gl = !"en".equals(getSharedPreferences("gingercal", 0).getString("lang", "gl"));
+        org.gingercal.net.CertVerifier.setRootStore(new org.gingercal.net.AssetRoots(this));
+        org.gingercal.net.Http.USER_AGENT = "GingerCal/1.4 (Android 2.3)";
+        tlsTexts();
+    }
+
+    /** The bundled TLS stack's messages, in the current language. */
+    static void tlsTexts() {
+        org.gingercal.net.CertVerifier.msgMismatch = L.t("The server certificate is for a different address (%1$s).");
+        org.gingercal.net.CertVerifier.msgDates = L.t("The server certificate has expired, or the phone's date is wrong.");
     }
 }