[Security] Exported Activity (TodoActivity) without permission protection

## Summary
Static analysis found 1 exported activity without permission protection.

**File:** app/src/main/AndroidManifest.xml:29
**Activity:** TodoActivity with

External apps can launch this activity with crafted intents.
**Fix:** Add or validate intent extras in onCreate().

**Scanner:** semgrep 1.162.0 on proot-distro Ubuntu 25.10

Start in app/src/main/AndroidManifest.xml at the TodoActivity declaration, then inspect TodoActivity's onCreate() for the intent inputs it accepts. Apply the stated protection or validate the intent extras, and confirm that external apps can no longer launch it unsafely and that the semgrep finding is resolved.

Written by the indexing model from the issue text.