GingerCal 1.4: bundled TLS 1.2, no bridge needed

CalDAV now goes through Minamp's own HTTP/TLS client (Bouncy Castle TLS 1.2, Mozilla
roots, keep-alive) instead of Apache HttpClient on Android 2.3's TLS 1.0, as the iPod
version does with BearSSL. The phone reaches the normal https:// Nextcloud address at
home and away; a pinned self-signed server or the old bridge still works.

- NetHttp transport; requests run on big-stack threads (the handshake overflows
  AsyncTask/IntentService stacks on Android 2.x)
- http:// -> https:// redirects on the same host are followed; other hosts still refused
- bridge wording replaced in Galician and English; README updated
- NetTest (TLS + CalDAV discovery through the new transport) replaces BridgeTest

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

android/org/gingercal/SettingsActivity.java

@@ -31,8 +31,8 @@ public class SettingsActivity extends Activity {
         LinearLayout f = App.vbox(this);
         int p = App.dp(this, 8);
         f.setPadding(p, p, p, p);
-        f.addView(App.text(this, L.t("Nextcloud server. Android 2.3 can't speak TLS 1.2, so use either your legacy-TLS bridge (https://cloud.example.com:8443) or http:// to the server on your home Wi-Fi. Use an app password, not your real one."), 12, 0xFFB0BEC5));
-        url = field(f, L.t("Server address"), "https://cloud.example.com:8443", 1 | 0x10 /* URI */);
+        f.addView(App.text(this, L.t("Nextcloud server: your normal https:// address. This app brings its own modern TLS, so no bridge is needed, at home or away. Use an app password, not your real one."), 12, 0xFFB0BEC5));
+        url = field(f, L.t("Server address"), "https://cloud.example.com", 1 | 0x10 /* URI */);
         user = field(f, L.t("User name"), "", 1 | 0x80000 /* no suggestions */);
         pass = field(f, L.t("App password"), "", 1 | 0x80 /* password */);
         pin = field(f, L.t("Pinned certificate SHA-256 (filled in for you)"), L.t("optional"), 1 | 0x80000);
@@ -99,6 +99,7 @@ public class SettingsActivity extends Activity {
                                 save();
                                 App.prefs(SettingsActivity.this).edit().putString("lang", toGl ? "gl" : "en").commit();
                                 L.gl = toGl;
+                                GingerApp.tlsTexts();
                                 finish(); // reopen so every label is redrawn in the new language
                                 startActivity(new Intent(SettingsActivity.this, SettingsActivity.class));
                             }
@@ -188,7 +189,7 @@ public class SettingsActivity extends Activity {
         }
         if (Dav.normalize(u).startsWith("http://") && !App.isLan(u)) {
             new AlertDialog.Builder(this).setTitle(L.t("Unencrypted connection"))
-                    .setMessage(L.t("http:// sends your password in clear text over the internet. Use the legacy-TLS bridge instead, or only use http:// to a LAN address."))
+                    .setMessage(L.t("http:// sends your password in clear text over the internet. Use the https:// address instead, or only use http:// to a LAN address."))
                     .setPositiveButton(L.t("Use anyway"), new DialogInterface.OnClickListener() {
                         public void onClick(DialogInterface d, int w) {
                             save();