MiniABS 1.1: HTTPS support

- Bundle current root certificates (Let's Encrypt, GTS, Sectigo, DigiCert G2,
  Amazon, ...) missing from Android 2.x's store (Roots.java, tools/gen_roots.py)
- Ask once for unknown certificates, showing the SHA-256 fingerprint, and
  remember the answer; replaces "accept any certificate" (Trust*, Settings)
- Local streaming proxy so Android 2.x's MediaPlayer can play https:// servers,
  with seeking and a fresh token per request (StreamProxy.java)
- Tests over real TLS with good, expired, wrong-host, forged and self-signed
  certificates (test/make_pki.sh, TrustTest.java)
- README: server setup for a legacy TLS 1.0 port

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/com/miniabs/PlayerService.java

@@ -129,6 +129,7 @@ public class PlayerService extends Service implements MediaPlayer.OnPreparedList
         if (ep != null && prepared && state != ENDED) syncNow(true);
         releasePlayer();
         net.shutdown();
+        StreamProxy.shutdown();
         try {
             unregisterReceiver(noisy);
         } catch (Exception ignored) {
@@ -380,6 +381,12 @@ public class PlayerService extends Service implements MediaPlayer.OnPreparedList
         });
     }
 
+    /** Direct URL for http:// servers; a local proxy URL for https:// ones (see StreamProxy). */
+    private static String streamUrl(Context c, String contentUrl) throws java.io.IOException {
+        if (StreamProxy.needed(c)) return StreamProxy.get(c).register(contentUrl);
+        return Api.withToken(c, Api.absolute(c, contentUrl));
+    }
+
     private Source findSource(Context c, Episode e, double startSec) {
         Source s = new Source();
         File f = Downloads.audio(c, e);
@@ -405,7 +412,7 @@ public class PlayerService extends Service implements MediaPlayer.OnPreparedList
                     s.error = "This episode needs transcoding, which Android 2.x can't play. Try downloading it.";
                 } else {
                     s.contentUrl = cu;
-                    s.url = Api.withToken(c, Api.absolute(c, cu));
+                    s.url = streamUrl(c, cu);
                 }
             }
         } catch (Exception ex) {
@@ -603,7 +610,11 @@ public class PlayerService extends Service implements MediaPlayer.OnPreparedList
                                 if (gen != generation) return;
                                 resumeMs = pos;
                                 playOnPrepared = wasPlaying;
-                                prepare(Api.withToken(ctx, Api.absolute(ctx, cu)), msg);
+                                try {
+                                    prepare(streamUrl(ctx, cu), msg);
+                                } catch (Exception ex) {
+                                    fail(Util.describe(ex));
+                                }
                             }
                         });
                     }