Security: Disable cleartext traffic or add network security config

## Problem

`AndroidManifest.xml:39` has `android:usesCleartextTraffic="true"`, which allows unencrypted HTTP traffic for all network requests. This is a security risk as data can be intercepted in transit.

## Location

- `app/src/main/AndroidManifest.xml` line 39

## Suggested Fix

**Option A (Preferred):** Remove the attribute entirely (defaults to `false` on API 28+):
```xml

```

**Option B:** Create a `network_security_config.xml` that restricts cleartext to debug builds only:
```xml

```

Then reference it in the manifest:
```xml
android:networkSecurityConfig="@xml/network_security_config"
```

## Effort
Low

Start in app/src/main/AndroidManifest.xml at line 39 and inspect how the current cleartext setting is used. Apply the preferred removal or the documented network security configuration, then verify the manifest and relevant build variants no longer permit unintended cleartext traffic.

Written by the indexing model from the issue text.