[chrisbrummel]

Restore Plex sign-in and secure server access on webOS 3.7 projectors

On an LG HU80KS-NA projector running webOS 3.7.0 (firmware 03.00.11), the tested stable client was incompatible, while the newer nightly could launch and provided responsive navigation. However, the nightly still could not complete Plex sign-in or connect securely to the Plex server. This PR addresses those remaining certificate compatibility barriers, turning the nightly's existing older-webOS support into a usable signed-in client with verified HTTPS server access on this device.

The underlying native runtime and older-webOS support were already present in upstream nightly revision 0dd6797c; this PR does not claim to introduce that support or upgrade the projector's OS. The contribution is the additional account/server TLS compatibility fixes, regression coverage, shipped certificate resources and documented device validation. No projector firmware or system certificate store was changed.

The device's libcurl 7.50.1/OpenSSL 1.0.2k returned curl error 60 for Plex account requests despite a valid remote certificate. Its system trust store could not validate the chain. Separately, server discovery succeeded only over HTTP because this firmware reports generic X509 result 1, which bypassed the existing public-root retry policy.

Ship the Mozilla public CA bundle and select it for parsed HTTPS host plex.tv through both public request entry points. For plex.direct hosts, permit one fully verified public-root retry after curl error 60/X509 result 1. Generic result 1 is not classified as proof of a missing issuer. Chain, date and hostname validation stay enabled; the date-pin policy is unchanged. The shared retry policy covers control requests and media curlio. No new native imports or ABI signatures are introduced.

Compatibility and validation:

• Installed an optimized ARM nightly as a separate developer application, preserving the original LG Plex installation and retaining prior packages for rollback. The owner reported substantially faster startup and library navigation than the original Plex app; this is qualitative device feedback, not a measured performance benchmark.
• On the webOS 3.7.0 device: account sign-in, persisted session and certificate-verified HTTPS access to the owned Plex server succeeded after these fixes.
• Regression tests failed before the respective fixes and passed afterward; network suite: 210 passed, 0 failed.
• Shipping-feature check, optimized ARM package build, all packaging assertions and packaged ELF provenance checks passed on the deployed implementation.
• Firmware 3.4.0 loader inventory check passed; this is static compatibility evidence, not a device test of that firmware. Other older-webOS devices have not been verified by this work.
• Encrypted playback is not established by the recorded attempt: the server's media share was unmounted, causing HTTP 404 for both direct play and transcoding. Secure server access and successful media playback are separate claims.
• Full make check was blocked at host linking by missing SDL2. No full-suite pass is claimed.

Related device work: #935 addresses Magic Remote cursor restoration during keypad navigation; the owner confirmed that stricter movement behavior worked well. It is a separate contribution and is not included in this PR.

Maintainer review points: preferred CA-bundle update/provenance workflow and whether selecting shipped roots for all Plex account HTTPS calls is the desired trust policy. Makefile/package changes have functional package validation; the repository-required before/after make build-bench measurement remains outstanding before this draft is ready for review.

Draft status: rebased onto upstream 8f3d3a0f. The functional device build and ARM/package checks above were performed on the earlier nightly baseline; a complete build of this rebased draft is still outstanding. Please keep this draft until required project checks are complete.