MiniABS 1.1: HTTPS support

- Bundle current root certificates (Let's Encrypt, GTS, Sectigo, DigiCert G2,
  Amazon, ...) missing from Android 2.x's store (Roots.java, tools/gen_roots.py)
- Ask once for unknown certificates, showing the SHA-256 fingerprint, and
  remember the answer; replaces "accept any certificate" (Trust*, Settings)
- Local streaming proxy so Android 2.x's MediaPlayer can play https:// servers,
  with seeking and a fresh token per request (StreamProxy.java)
- Tests over real TLS with good, expired, wrong-host, forged and self-signed
  certificates (test/make_pki.sh, TrustTest.java)
- README: server setup for a legacy TLS 1.0 port

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/com/miniabs/ApiTest.java

@@ -48,7 +48,7 @@ public class ApiTest {
         check(cut.getString("d").equals("0123456789…"), "long strings truncated with an ellipsis");
 
         System.out.println("Sign-in");
-        p.setServer(LoginActivity_normalize(base + "/login/"), false);
+        p.setServer(LoginActivity_normalize(base + "/login/"));
         check(p.server().equals(base), "address normalised (" + p.server() + ")");
         check(Api.status(c, p.server()).equals("2.30.0"), "status check finds the server");
         try {
@@ -193,7 +193,7 @@ public class ApiTest {
         }
 
         System.out.println("Sub-path servers");
-        p.setServer("http://nas.local:8080/abs", false);
+        p.setServer("http://nas.local:8080/abs");
         check(Api.absolute(c, "/abs/api/items/x/file/1").equals("http://nas.local:8080/abs/api/items/x/file/1"),
                 "content URL under a sub-path not doubled");
         check(Api.absolute(c, "/api/items/x/file/1").equals("http://nas.local:8080/abs/api/items/x/file/1"),