GingerCal 1.4: bundled TLS 1.2, no bridge needed

CalDAV now goes through Minamp's own HTTP/TLS client (Bouncy Castle TLS 1.2, Mozilla
roots, keep-alive) instead of Apache HttpClient on Android 2.3's TLS 1.0, as the iPod
version does with BearSSL. The phone reaches the normal https:// Nextcloud address at
home and away; a pinned self-signed server or the old bridge still works.

- NetHttp transport; requests run on big-stack threads (the handshake overflows
  AsyncTask/IntentService stacks on Android 2.x)
- http:// -> https:// redirects on the same host are followed; other hosts still refused
- bridge wording replaced in Galician and English; README updated
- NetTest (TLS + CalDAV discovery through the new transport) replaces BridgeTest

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

android/org/gingercal/net/DiagLog.java

@@ -0,0 +1,47 @@
+package org.gingercal.net;
+
+import java.text.SimpleDateFormat;
+import java.util.ArrayList;
+import java.util.Date;
+import java.util.List;
+import java.util.Locale;
+
+/**
+ * In-memory diagnostics log (last few hundred lines): every request with its status and timing,
+ * sign-in steps, stream attempts. Viewable in the app and savable to the SD card, so a problem
+ * on a real server can be reported precisely. Tokens are never logged.
+ */
+public final class DiagLog {
+    private static final int MAX = 400;
+    private static final List<String> lines = new ArrayList<String>();
+    private static final SimpleDateFormat fmt = new SimpleDateFormat("HH:mm:ss", Locale.US);
+
+    private DiagLog() {}
+
+    public static void log(String msg) {
+        String line;
+        synchronized (fmt) { line = fmt.format(new Date()) + " " + msg; }
+        synchronized (lines) {
+            lines.add(line);
+            if (lines.size() > MAX) lines.remove(0);
+        }
+    }
+
+    public static String dump() {
+        StringBuilder sb = new StringBuilder();
+        synchronized (lines) {
+            for (int i = 0; i < lines.size(); i++) sb.append(lines.get(i)).append('\n');
+        }
+        return sb.toString();
+    }
+
+    public static void clear() {
+        synchronized (lines) { lines.clear(); }
+    }
+
+    /** URL without the token value, safe to show and share. */
+    public static String redact(String url) {
+        if (url == null) return "";
+        return url.replaceAll("((?:X-Plex-Token|token|T|Passwd)=)[^&]*", "$1***");
+    }
+}