MiniABS 1.1: HTTPS support

- Bundle current root certificates (Let's Encrypt, GTS, Sectigo, DigiCert G2,
  Amazon, ...) missing from Android 2.x's store (Roots.java, tools/gen_roots.py)
- Ask once for unknown certificates, showing the SHA-256 fingerprint, and
  remember the answer; replaces "accept any certificate" (Trust*, Settings)
- Local streaming proxy so Android 2.x's MediaPlayer can play https:// servers,
  with seeking and a fresh token per request (StreamProxy.java)
- Tests over real TLS with good, expired, wrong-host, forged and self-signed
  certificates (test/make_pki.sh, TrustTest.java)
- README: server setup for a legacy TLS 1.0 port

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/run_tests.sh

@@ -1,5 +1,5 @@
 #!/bin/sh
-# Runs MiniABS's API/JSON/progress code on the desktop JVM against mock_abs.py.
+# Runs MiniABS's API/JSON/progress/HTTPS code on the desktop JVM against mock_abs.py.
 set -e
 cd "$(dirname "$0")/.."
 OUT=build/test
@@ -7,14 +7,30 @@ JSON_JAR=/usr/share/java/com.android.json.jar
 rm -rf "$OUT" && mkdir -p "$OUT"
 S=src/com/miniabs
 javac -nowarn -encoding UTF-8 -cp "$JSON_JAR" -d "$OUT" $(find test/shim -name '*.java') \
-    $S/Json.java $S/Prefs.java $S/Episode.java $S/Util.java $S/Api.java $S/App.java test/com/miniabs/ApiTest.java
+    $S/Json.java $S/Prefs.java $S/Episode.java $S/Util.java $S/Api.java $S/App.java \
+    $S/Trust.java $S/Roots.java $S/StreamProxy.java \
+    test/com/miniabs/ApiTest.java test/com/miniabs/TrustTest.java
+CP="$OUT:$JSON_JAR"
+PIDS=""
+cleanup() { [ -n "$PIDS" ] && kill $PIDS 2>/dev/null || true; }
+trap cleanup EXIT
+port() { echo $((20000 + $(od -An -N2 -tu2 /dev/urandom | tr -d ' ') % 20000)); }
 
 for mode in current legacy; do
-    PORT=$((18000 + $(od -An -N2 -tu2 /dev/urandom | tr -d ' ') % 1000))
-    python3 test/mock_abs.py $PORT $mode &
-    PID=$!
+    P=$(port)
+    python3 test/mock_abs.py $P $mode & PIDS="$PIDS $!"
     sleep 1
-    echo "=== $mode server"
-    java -cp "$OUT:$JSON_JAR" com.miniabs.ApiTest $PORT $mode || { kill $PID; exit 1; }
-    kill $PID
+    echo "=== $mode server (http)"
+    java -cp "$CP" com.miniabs.ApiTest $P $mode
 done
+
+echo "=== https"
+test/make_pki.sh build/pki > /dev/null
+ARGS="build/pki"
+for chain in good wronghost forged expired self; do
+    P=$(port)
+    python3 test/mock_abs.py $P current build/pki/$chain.chain & PIDS="$PIDS $!"
+    ARGS="$ARGS $P"
+done
+sleep 1
+java -cp "$CP" com.miniabs.TrustTest $ARGS