v0.1.0-beta.4

Android can finally reach a self-hosted server — over plain HTTP on your LAN, or HTTPS with your own CA.

What's new

Self-hosted servers work on Android (#79)
Android blocks two things by default that this app's whole setup depends on: plain HTTP
(since Android 9) and certificates from a CA you installed yourself (since Android 7).
Between them, the documented "point the app at http://<lan-ip>:8080" path could not work
at all, and a private CA that your phone's browser accepts was invisible to the app. Both
are now permitted. HTTPS is still fully validated — chain, expiry, and hostname are checked
exactly as before; the only change is that roots you deliberately installed also count.
This is a native change, so it only takes effect in a new build — not over an app update.

Plain HTTP is now labelled, not silently accepted (#79)
An http:// server URL carries an amber "Not encrypted" marker wherever it appears, on the
login screen and in Settings. Over plain HTTP your login and session token cross the network
in the clear, and anyone sharing that network can read them — so the app says so, and the
docs lead with HTTPS everywhere. localhost is exempt; it never leaves the device.

Prefill new program sets (#78)
Adding a set to a program routine now starts from the previous set's reps and weight instead
of an empty row.

Fixes & improvements

• Network failures now name their actual cause — a blocked cleartext connection, an untrusted
  certificate, a hostname mismatch, a timeout — instead of blaming CORS, which mobile never
  evaluates in the first place (#79)
• The web barcode scanner explains itself when the camera can't open: browsers only grant
  camera access on HTTPS or localhost (#79)
• The web app warns when an HTTPS page is pointed at an http:// server, which the browser
  will block as mixed content (#79)
• API requests have a timeout, so an unreachable server fails instead of hanging forever (#79)
• Backend, web, and mobile now build and release under one pipeline and one tag (#77)

Contributors

@pdschneider (#79) — reported it, dug into the cause, and tested the fix against their own
reverse proxy and CA
@Cawlumm (#77, #78, #82)