GingerCal 1.4: bundled TLS 1.2, no bridge needed

CalDAV now goes through Minamp's own HTTP/TLS client (Bouncy Castle TLS 1.2, Mozilla
roots, keep-alive) instead of Apache HttpClient on Android 2.3's TLS 1.0, as the iPod
version does with BearSSL. The phone reaches the normal https:// Nextcloud address at
home and away; a pinned self-signed server or the old bridge still works.

- NetHttp transport; requests run on big-stack threads (the handshake overflows
  AsyncTask/IntentService stacks on Android 2.x)
- http:// -> https:// redirects on the same host are followed; other hosts still refused
- bridge wording replaced in Galician and English; README updated
- NetTest (TLS + CalDAV discovery through the new transport) replaces BridgeTest

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/org/gingercal/NetTest.java

@@ -0,0 +1,55 @@
+package org.gingercal;
+
+import java.io.File;
+import java.io.IOException;
+import java.util.Collections;
+import java.util.List;
+
+import org.gingercal.net.CertVerifier;
+
+/**
+ * The phone's transport (NetHttp: bundled TLS 1.2 client, any method, keep-alive) on a desktop JVM:
+ * CalDAV discovery against a local Radicale, and certificate checks against real HTTPS servers.
+ *   java -cp out org.gingercal.NetTest assets/roots [http://127.0.0.1:5232 user pass]
+ */
+public class NetTest {
+    static int fails;
+
+    static void check(boolean ok, String what) {
+        System.out.println((ok ? "  ok   " : "  FAIL ") + what);
+        if (!ok) fails++;
+    }
+
+    public static void main(String[] a) throws Exception {
+        final File roots = new File(a[0]);
+        CertVerifier.setRootStore(new CertVerifier.RootStore() {
+            public List<byte[]> find(byte[] subject) {
+                File f = new File(roots, CertVerifier.sha1Hex(subject) + "-0.der");
+                try {
+                    return f.exists() ? Collections.singletonList(java.nio.file.Files.readAllBytes(f.toPath())) : null;
+                } catch (IOException e) {
+                    return null;
+                }
+            }
+        });
+        NetHttp h = new NetHttp("", 20000);
+        Http.Resp r = h.execHere("GET", "https://nxc.anosanube.ovh/status.php", new String[0], null, null);
+        check(r.code == 200 && r.body.contains("installed"), "Nextcloud over TLS 1.2 with Mozilla roots");
+        try {
+            h.execHere("GET", "https://self-signed.badssl.com/", new String[0], null, null);
+            check(false, "self-signed refused");
+        } catch (DavException.UntrustedCert u) {
+            check(!u.pinMismatch && u.fingerprint.length() == 95, "self-signed -> trust prompt data");
+            Http.Resp p = new NetHttp(u.fingerprint, 20000).execHere("GET", "https://self-signed.badssl.com/", new String[0], null, null);
+            check(p.code == 200, "pinned self-signed accepted");
+        }
+        if (a.length >= 4) {
+            Dav d = new Dav(new NetHttp("", 20000), a[1], a[2], a[3]);
+            String home = d.calendarHome();
+            List<Model.Cal> cals = d.calendars(home);
+            check(home != null && !cals.isEmpty(), "CalDAV discovery: " + cals.size() + " calendars at " + home);
+        }
+        System.out.println(fails == 0 ? "ALL PASSED" : fails + " FAILED");
+        System.exit(fails == 0 ? 0 : 1);
+    }
+}