MiniABS 1.7: bundled TLS 1.2, no legacy HTTPS port needed

All requests (API, covers, downloads, the streaming proxy) go through Minamp's own
HTTP/TLS client (Bouncy Castle TLS 1.2, Mozilla roots, keep-alive, session
resumption) via NetConnection, a drop-in HttpURLConnection, as the iPod version does
with BearSSL. The phone reaches the normal https:// address directly; nothing changes
on the server.

- Trust: Mozilla roots + the user's pinned CAs/certificates feed the new verifier; the
  trust prompt, renew-safe CA pinning and forged-chain protection behave as before
- PATCH is a normal request now (no raw-socket path)
- Job, covers, player, downloads and proxy threads get big stacks for the handshake
- embedded Roots.java and gen_roots.py replaced by assets/roots
- tests: desktop shims read assets; all 104 checks pass (HTTP and HTTPS)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/shim/android/content/Context.java

@@ -6,6 +6,8 @@ public class Context {
     private final HashMap<String, SharedPreferences> prefs = new HashMap<String, SharedPreferences>();
     public static boolean online = true;
     public Context getApplicationContext() { return this; }
+    private final android.content.res.AssetManager assets = new android.content.res.AssetManager();
+    public android.content.res.AssetManager getAssets() { return assets; }
     public synchronized SharedPreferences getSharedPreferences(String name, int mode) {
         SharedPreferences p = prefs.get(name);
         if (p == null) { p = new SharedPreferences(); prefs.put(name, p); }