[FEATURE] Exclude app data directory from OS auto-backup (iOS + Android)

[Jberma23]

Description

Per ADR 0003 — Device-level encryption for exports, backups, and OS auto-backup, Risk 1: both iOS and Android back up an app's local files by default (iCloud Backup / Google Auto Backup) with no explicit upload action required. This quietly contradicts our "no cloud storage of medical data in MVP" position even though we've never built a cloud feature.

Exclude our data directory from OS auto-backup outright. This is independent of the export/backup feature timeline and should be done early — it's a config-level fix, not a new feature.

• Android: set android.allowBackup: false in app.json (native Expo config key, no plugin required).
• iOS: exclude data files from iCloud/iTunes backup via the NSURLIsExcludedFromBackupKey file attribute. Unlike Android, this isn't a static Info.plist/app.json setting — it has to be applied to files at write time (native module or config plugin), so confirm the right hook for our storage layer before implementing.

Acceptance Criteria

• Android: android.allowBackup set to false, verified the app is excluded from Google Auto Backup
• iOS: app's data directory/files carry NSURLIsExcludedFromBackupKey, verified excluded from iCloud/iTunes backup
• Verified on a real device (or simulator backup/restore test) for both platforms, not just config inspection
• No functional regression to existing local storage/reads
• The feature/s being implemented are covered by unit tests - If not, create tests for them on this ticket

Additional Info and Resources

• Source: 0003-device-encryption-exports-backups.md, Risk 1
• Related but out of scope for this ticket: Risk 2 (encrypted device-transfer backup/restore file) and Risk 3 (optional PDF password protection) are contingent on those features being built later.
• iOS mechanism needs a short spike to confirm the correct implementation point in an Expo managed workflow (config plugin vs. native module) since NSURLIsExcludedFromBackupKey isn't a declarative config key like Android's.

QA

• On Android, back up device to Google account, reinstall app, confirm app data is not restored/present
• On iOS, trigger iCloud backup, reinstall app, confirm app data is not restored/present
• Confirm no other app functionality (local read/write) is affected

Sources:

app.json / app.config.js - Expo Documentation
Back up user data with Auto Backup | Android Developers
Prevent your app's files from being included in iCloud Backup