MiniABS 1.1: HTTPS support

- Bundle current root certificates (Let's Encrypt, GTS, Sectigo, DigiCert G2,
  Amazon, ...) missing from Android 2.x's store (Roots.java, tools/gen_roots.py)
- Ask once for unknown certificates, showing the SHA-256 fingerprint, and
  remember the answer; replaces "accept any certificate" (Trust*, Settings)
- Local streaming proxy so Android 2.x's MediaPlayer can play https:// servers,
  with seeking and a fresh token per request (StreamProxy.java)
- Tests over real TLS with good, expired, wrong-host, forged and self-signed
  certificates (test/make_pki.sh, TrustTest.java)
- README: server setup for a legacy TLS 1.0 port

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

res/xml/settings.xml

@@ -39,6 +39,9 @@
         <Preference
             android:key="account"
             android:title="Signed in" />
+        <Preference
+            android:key="pins"
+            android:title="Certificates you trusted" />
         <Preference
             android:key="logout"
             android:title="Log out" />
@@ -47,7 +50,7 @@
     <PreferenceCategory android:title="About">
         <Preference
             android:key="about"
-            android:title="MiniABS 1.0"
+            android:title="MiniABS 1.1"
             android:summary="A tiny Audiobookshelf podcast client for Android 2.2+" />
     </PreferenceCategory>
 </PreferenceScreen>