MiniABS 1.7: bundled TLS 1.2, no legacy HTTPS port needed

All requests (API, covers, downloads, the streaming proxy) go through Minamp's own
HTTP/TLS client (Bouncy Castle TLS 1.2, Mozilla roots, keep-alive, session
resumption) via NetConnection, a drop-in HttpURLConnection, as the iPod version does
with BearSSL. The phone reaches the normal https:// address directly; nothing changes
on the server.

- Trust: Mozilla roots + the user's pinned CAs/certificates feed the new verifier; the
  trust prompt, renew-safe CA pinning and forged-chain protection behave as before
- PATCH is a normal request now (no raw-socket path)
- Job, covers, player, downloads and proxy threads get big stacks for the handshake
- embedded Roots.java and gen_roots.py replaced by assets/roots
- tests: desktop shims read assets; all 104 checks pass (HTTP and HTTPS)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

build.sh

@@ -6,18 +6,19 @@ set -e
 cd "$(dirname "$0")"
 ANDROID_JAR=${ANDROID_JAR:-/home/claude/sable/android-platforms/android-8/android.jar}
 KEYSTORE=${KEYSTORE:-miniabs.keystore}
+BC_SRC=${BC_SRC:-$HOME/android-toolchain/bcsrc}   # Bouncy Castle renamed to com.minamp.bc (Minamp's tools/setup_toolchain.sh)
 OUT=build
 
 rm -rf "$OUT"
 mkdir -p "$OUT/gen" "$OUT/classes"
 
 echo "== resources"
-aapt package -f -m -J "$OUT/gen" -M AndroidManifest.xml -S res -I "$ANDROID_JAR" \
+aapt package -f -m -J "$OUT/gen" -M AndroidManifest.xml -S res -A assets -I "$ANDROID_JAR" \
     -F "$OUT/MiniABS.unsigned.apk"
 
 echo "== compile (Java 8 bytecode, API 8 class library)"
 javac -nowarn -Xlint:-options -encoding UTF-8 -source 8 -target 8 \
-    -bootclasspath "$ANDROID_JAR" -classpath "$ANDROID_JAR" \
+    -bootclasspath "$ANDROID_JAR" -classpath "$ANDROID_JAR" -sourcepath "src:$BC_SRC:$OUT/gen" \
     -d "$OUT/classes" $(find src "$OUT/gen" -name '*.java')
 
 echo "== dex"