Minamp 1.4: faster connecting

- Remember the connection that worked and try it alone first next start
- Prefer plain HTTP on the home network (each TLS handshake costs seconds on a
  600 MHz phone); new setting "Encrypt at home too" to keep HTTPS
- Try secure addresses one at a time instead of in parallel, so they don't
  all time out together
- TLS 1.2 with session resumption: reconnects skip the full handshake
- Cache certificate chains already verified; changing the trusted roots
  clears that cache and all TLS sessions
- README: updated connection order; test: session resumption check and
  HandshakeProfile

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -25,10 +25,15 @@ working one, re-checking whenever the phone switches network:
 
 | Order | Connection | When it's used |
 |---|---|---|
-| 1 | Home network, HTTPS (`*.plex.direct`) | On your Wi-Fi |
-| 2 | Home network, plain HTTP | Same, if your router blocks plex.direct DNS (rebind protection) |
-| 3 | Remote, HTTPS | Away, if Remote Access is set up on the server |
-| 4 | Plex Relay | Away, when the server isn't reachable directly (bandwidth-capped; Minamp caps itself at 192 kbps) |
+| 1 | Whatever worked last time | Tried alone first, so a normal start costs one request |
+| 2 | Home network, plain HTTP | On your Wi-Fi (fast: no encryption work for the phone) |
+| 3 | Home network, HTTPS (`*.plex.direct`) | On your Wi-Fi if plain HTTP is refused, or if *Settings → Encrypt at home too* is on |
+| 4 | Remote, HTTPS | Away, if Remote Access is set up on the server |
+| 5 | Plex Relay | Away, when the server isn't reachable directly (bandwidth-capped; Minamp caps itself at 192 kbps) |
+
+Secure addresses are tried one at a time: on a 600 MHz phone a TLS handshake takes seconds, and
+several at once make each of them time out. Minamp uses TLS 1.2 with session resumption, so only
+the first connection to each server pays the full cost; later ones resume in a fraction of it.
 
 For the best remote experience enable **Settings → Remote Access** on your Plex Media Server.
 Without it, Relay still works.