MiniABS 1.1: HTTPS support

- Bundle current root certificates (Let's Encrypt, GTS, Sectigo, DigiCert G2,
  Amazon, ...) missing from Android 2.x's store (Roots.java, tools/gen_roots.py)
- Ask once for unknown certificates, showing the SHA-256 fingerprint, and
  remember the answer; replaces "accept any certificate" (Trust*, Settings)
- Local streaming proxy so Android 2.x's MediaPlayer can play https:// servers,
  with seeking and a fresh token per request (StreamProxy.java)
- Tests over real TLS with good, expired, wrong-host, forged and self-signed
  certificates (test/make_pki.sh, TrustTest.java)
- README: server setup for a legacy TLS 1.0 port

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/com/miniabs/BaseActivity.java

@@ -64,9 +64,20 @@ abstract class BaseActivity extends Activity {
             finish();
             return;
         }
+        if (offerTrust(null)) return;
         toast(Util.describe(e));
     }
 
+    /** If a request just failed on an unrecognised certificate, ask about it. retry runs after trusting. */
+    protected boolean offerTrust(final Runnable retry) {
+        return TrustPrompt.offer(this, new Runnable() {
+            public void run() {
+                if (retry != null) retry.run();
+                else toast("Certificate trusted. Try again.");
+            }
+        });
+    }
+
     // ------------------------------------------------------------ mini player
 
     protected void setupMiniBar() {