MiniABS 1.7: bundled TLS 1.2, no legacy HTTPS port needed

All requests (API, covers, downloads, the streaming proxy) go through Minamp's own
HTTP/TLS client (Bouncy Castle TLS 1.2, Mozilla roots, keep-alive, session
resumption) via NetConnection, a drop-in HttpURLConnection, as the iPod version does
with BearSSL. The phone reaches the normal https:// address directly; nothing changes
on the server.

- Trust: Mozilla roots + the user's pinned CAs/certificates feed the new verifier; the
  trust prompt, renew-safe CA pinning and forged-chain protection behave as before
- PATCH is a normal request now (no raw-socket path)
- Job, covers, player, downloads and proxy threads get big stacks for the handshake
- embedded Roots.java and gen_roots.py replaced by assets/roots
- tests: desktop shims read assets; all 104 checks pass (HTTP and HTTPS)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/run_tests.sh

@@ -3,12 +3,14 @@
 set -e
 cd "$(dirname "$0")/.."
 OUT=build/test
-JSON_JAR=/usr/share/java/com.android.json.jar
+JSON_JAR=${JSON_JAR:-/usr/share/java/com.android.json.jar}   # any org.json works (e.g. org.json:json from Maven)
+BC_SRC=${BC_SRC:-$HOME/android-toolchain/bcsrc}
 rm -rf "$OUT" && mkdir -p "$OUT"
 S=src/com/miniabs
-javac -nowarn -encoding UTF-8 -cp "$JSON_JAR" -d "$OUT" $(find test/shim -name '*.java') \
+javac -nowarn -encoding UTF-8 -cp "$JSON_JAR" -sourcepath "$BC_SRC" -d "$OUT" $(find test/shim -name '*.java') \
     $S/Json.java $S/Prefs.java $S/Episode.java $S/Util.java $S/Api.java $S/App.java \
-    $S/Trust.java $S/Roots.java $S/StreamProxy.java \
+    $S/Trust.java $S/NetConnection.java $S/net/Http.java $S/net/CertVerifier.java $S/net/AssetRoots.java \
+    $S/net/DiagLog.java $S/net/Threads.java $S/StreamProxy.java \
     test/com/miniabs/ApiTest.java test/com/miniabs/TrustTest.java
 CP="$OUT:$JSON_JAR"
 PIDS=""