MiniABS 1.7: bundled TLS 1.2, no legacy HTTPS port needed

All requests (API, covers, downloads, the streaming proxy) go through Minamp's own
HTTP/TLS client (Bouncy Castle TLS 1.2, Mozilla roots, keep-alive, session
resumption) via NetConnection, a drop-in HttpURLConnection, as the iPod version does
with BearSSL. The phone reaches the normal https:// address directly; nothing changes
on the server.

- Trust: Mozilla roots + the user's pinned CAs/certificates feed the new verifier; the
  trust prompt, renew-safe CA pinning and forged-chain protection behave as before
- PATCH is a normal request now (no raw-socket path)
- Job, covers, player, downloads and proxy threads get big stacks for the handshake
- embedded Roots.java and gen_roots.py replaced by assets/roots
- tests: desktop shims read assets; all 104 checks pass (HTTP and HTTPS)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tools/gen_roots.py

@@ -1,52 +0,0 @@
-"""Generates src/com/miniabs/Roots.java: modern RSA root certificates that Android 2.3's
-built-in list lacks (Let's Encrypt, Google Trust Services, Sectigo/ZeroSSL, ...).
-
-Only RSA roots: Android 2.x's TLS 1.0 can't use ECDSA certificates anyway.
-Run: python3 tools/gen_roots.py /etc/ssl/certs
-"""
-import base64
-import hashlib
-import os
-import re
-import sys
-
-CERT_DIR = sys.argv[1] if len(sys.argv) > 1 else "/etc/ssl/certs"
-NAMES = [
-    "ISRG_Root_X1",                                  # Let's Encrypt
-    "GTS_Root_R1",                                   # Google Trust Services (also Cloudflare)
-    "USERTrust_RSA_Certification_Authority",         # Sectigo, ZeroSSL
-    "DigiCert_Global_Root_G2",
-    "Amazon_Root_CA_1",
-    "Microsoft_RSA_Root_Certificate_Authority_2017",
-    "SSL.com_Root_Certification_Authority_RSA",
-    "Buypass_Class_2_Root_CA",
-    "HARICA_TLS_RSA_Root_CA_2021",
-    "Certum_Trusted_Network_CA",
-    "Go_Daddy_Root_Certificate_Authority_-_G2",
-    "Starfield_Root_Certificate_Authority_-_G2",
-]
-
-out = []
-for n in NAMES:
-    pem = open(os.path.join(CERT_DIR, n + ".pem")).read()
-    b64 = "".join(re.search(r"-----BEGIN CERTIFICATE-----(.*?)-----END CERTIFICATE-----", pem, re.S).group(1).split())
-    der = base64.b64decode(b64)
-    out.append((n, b64, hashlib.sha256(der).hexdigest()))
-
-lines = [
-    "package com.miniabs;",
-    "",
-    "/** Generated by tools/gen_roots.py from the system CA store. Do not edit. */",
-    "final class Roots {",
-    "    private Roots() {",
-    "    }",
-    "",
-    "    static final String[] DER_BASE64 = {",
-]
-for n, b64, sha in out:
-    lines.append("        // %s  sha256=%s" % (n, sha))
-    chunks = [b64[i:i + 100] for i in range(0, len(b64), 100)]
-    lines.append("        " + "\n                + ".join('"%s"' % c for c in chunks) + ",")
-lines += ["    };", "}", ""]
-open(os.path.join(os.path.dirname(__file__), "..", "src", "com", "miniabs", "Roots.java"), "w").write("\n".join(lines))
-print("%d roots written" % len(out))