MiniABS 1.1: HTTPS support

- Bundle current root certificates (Let's Encrypt, GTS, Sectigo, DigiCert G2,
  Amazon, ...) missing from Android 2.x's store (Roots.java, tools/gen_roots.py)
- Ask once for unknown certificates, showing the SHA-256 fingerprint, and
  remember the answer; replaces "accept any certificate" (Trust*, Settings)
- Local streaming proxy so Android 2.x's MediaPlayer can play https:// servers,
  with seeking and a fresh token per request (StreamProxy.java)
- Tests over real TLS with good, expired, wrong-host, forged and self-signed
  certificates (test/make_pki.sh, TrustTest.java)
- README: server setup for a legacy TLS 1.0 port

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/com/miniabs/LoginActivity.java

@@ -14,7 +14,7 @@ import android.widget.TextView;
 
 public class LoginActivity extends Activity {
     private EditText server, user, pass;
-    private CheckBox useKey, trust;
+    private CheckBox useKey;
     private TextView status, userLabel, passLabel;
     private Button connect;
 
@@ -26,7 +26,6 @@ public class LoginActivity extends Activity {
         user = (EditText) findViewById(R.id.user);
         pass = (EditText) findViewById(R.id.pass);
         useKey = (CheckBox) findViewById(R.id.use_key);
-        trust = (CheckBox) findViewById(R.id.trust);
         status = (TextView) findViewById(R.id.status);
         userLabel = (TextView) findViewById(R.id.user_label);
         passLabel = (TextView) findViewById(R.id.pass_label);
@@ -35,7 +34,6 @@ public class LoginActivity extends Activity {
         Prefs p = Prefs.get(this);
         server.setText(p.server());
         user.setText(p.username());
-        trust.setChecked(p.trustAll());
         String msg = getIntent().getStringExtra("message");
         if (msg != null) status.setText(msg);
 
@@ -87,7 +85,8 @@ public class LoginActivity extends Activity {
         p.logout();
         App.clear();
         HomeActivity.clearCache();
-        p.setServer(srv, trust.isChecked());
+        p.setServer(srv);
+        Trust.lastRejected = null;
         new Job<String>() {
             String work() throws Exception {
                 String version = Api.status(LoginActivity.this, srv);
@@ -111,6 +110,11 @@ public class LoginActivity extends Activity {
             void failed(Exception e) {
                 connect.setEnabled(true);
                 status.setText(Util.describe(e));
+                TrustPrompt.offer(LoginActivity.this, new Runnable() {
+                    public void run() {
+                        go();
+                    }
+                });
             }
         }.start();
     }