MiniABS 1.7: bundled TLS 1.2, no legacy HTTPS port needed

All requests (API, covers, downloads, the streaming proxy) go through Minamp's own
HTTP/TLS client (Bouncy Castle TLS 1.2, Mozilla roots, keep-alive, session
resumption) via NetConnection, a drop-in HttpURLConnection, as the iPod version does
with BearSSL. The phone reaches the normal https:// address directly; nothing changes
on the server.

- Trust: Mozilla roots + the user's pinned CAs/certificates feed the new verifier; the
  trust prompt, renew-safe CA pinning and forged-chain protection behave as before
- PATCH is a normal request now (no raw-socket path)
- Job, covers, player, downloads and proxy threads get big stacks for the handshake
- embedded Roots.java and gen_roots.py replaced by assets/roots
- tests: desktop shims read assets; all 104 checks pass (HTTP and HTTPS)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/com/miniabs/PlayerService.java

@@ -62,7 +62,7 @@ public class PlayerService extends Service implements MediaPlayer.OnPreparedList
     }
 
     private final Handler h = new Handler();
-    private final ExecutorService net = Executors.newSingleThreadExecutor();
+    private final ExecutorService net = com.miniabs.net.Threads.pool("player-net", 1);
 
     private AudioManager am;
     private WifiManager.WifiLock wifi;