[Mobile] Define secure notification redaction modes for health data

## Problem
Push notifications can expose pet names, medication names, or medical details on a locked device shared with other people.

## Scope
Add notification privacy levels and ensure local, remote, and notification-action payloads honor the selected mode.

## Acceptance criteria
- Users can choose full, minimal, or silent health notification content.
- Lock-screen payloads in minimal mode contain no diagnosis, medication, or location data.
- Notification actions still work without putting sensitive data into the payload.
- Preference changes are synchronized safely and have a documented default.
- Tests inspect APNs/FCM payloads and local notification content for every mode.

Start by locating the notification payload builders and preference-synchronization entry points, then trace APNs/FCM payloads, local notification content, and notification actions. Define and test full, minimal, and silent modes, including a documented default; done means every payload and local notification avoids prohibited health data while actions continue to work.

Written by the indexing model from the issue text.