MiniABS 1.1: HTTPS support

- Bundle current root certificates (Let's Encrypt, GTS, Sectigo, DigiCert G2,
  Amazon, ...) missing from Android 2.x's store (Roots.java, tools/gen_roots.py)
- Ask once for unknown certificates, showing the SHA-256 fingerprint, and
  remember the answer; replaces "accept any certificate" (Trust*, Settings)
- Local streaming proxy so Android 2.x's MediaPlayer can play https:// servers,
  with seeking and a fresh token per request (StreamProxy.java)
- Tests over real TLS with good, expired, wrong-host, forged and self-signed
  certificates (test/make_pki.sh, TrustTest.java)
- README: server setup for a legacy TLS 1.0 port

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/com/miniabs/Prefs.java

@@ -36,7 +36,6 @@ final class Prefs {
     String token() { return s("access"); }
     String refreshToken() { return s("refresh"); }
     String mode() { return s("mode"); }
-    boolean trustAll() { return sp.getBoolean("trust_all", false); }
     boolean wifiOnly() { return sp.getBoolean("wifi_only", true); }
     boolean covers() { return sp.getBoolean("covers", true); }
     String libraryId() { return s("library_id"); }
@@ -61,8 +60,8 @@ final class Prefs {
         return MODE_JWT.equals(mode()) && refreshToken().length() > 0;
     }
 
-    void setServer(String server, boolean trustAll) {
-        sp.edit().putString("server", server).putBoolean("trust_all", trustAll).commit();
+    void setServer(String server) {
+        sp.edit().putString("server", server).remove("trust_all").commit();
     }
 
     synchronized void setAuth(String user, String mode, String access, String refresh) {