MiniABS 1.1: HTTPS support

- Bundle current root certificates (Let's Encrypt, GTS, Sectigo, DigiCert G2,
  Amazon, ...) missing from Android 2.x's store (Roots.java, tools/gen_roots.py)
- Ask once for unknown certificates, showing the SHA-256 fingerprint, and
  remember the answer; replaces "accept any certificate" (Trust*, Settings)
- Local streaming proxy so Android 2.x's MediaPlayer can play https:// servers,
  with seeking and a fresh token per request (StreamProxy.java)
- Tests over real TLS with good, expired, wrong-host, forged and self-signed
  certificates (test/make_pki.sh, TrustTest.java)
- README: server setup for a legacy TLS 1.0 port

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/com/miniabs/HomeActivity.java

@@ -178,6 +178,12 @@ public class HomeActivity extends BaseActivity {
         empty.setVisibility(msg == null ? View.GONE : View.VISIBLE);
     }
 
+    private final Runnable retryRefresh = new Runnable() {
+        public void run() {
+            refresh();
+        }
+    };
+
     private void refresh() {
         App.invalidate();
         Covers.clearMemory();
@@ -315,6 +321,10 @@ public class HomeActivity extends BaseActivity {
                     return;
                 }
                 latestError = Util.describe(e) + "\n\nTap refresh to try again.";
+                if (offerTrust(retryRefresh)) {
+                    if (tab == TAB_LATEST) show(null, null);
+                    return;
+                }
                 if (tab == TAB_LATEST) offlineFallback(e);
             }
         }.start();
@@ -369,6 +379,10 @@ public class HomeActivity extends BaseActivity {
                     return;
                 }
                 showsError = Util.describe(e) + "\n\nTap refresh to try again.";
+                if (offerTrust(retryRefresh)) {
+                    if (tab == TAB_SHOWS) show(null, null);
+                    return;
+                }
                 if (tab == TAB_SHOWS) offlineFallback(e);
             }
         }.start();