fix(leak): card view-models never store/cancel stream subscriptions; heart-rate StreamGroup never closed

## Problem
(verified) `heartRateStream?.listen(...)` (`lib/view_models/cards/heart_rate_data_model.dart:42`) with a broadcast `StreamGroup` that is never closed (`heart_rate_data_model.dart:17`); `pedometerEvents?.listen` (`steps_data_model.dart:46`); `activityEvents?.listen` (`activity_data_model.dart:45`); `mobilityEvents?.listen` (`mobility_data_model.dart:41`). None store the subscription; none override `dispose()`. A second `init()` (leave study → join new study in one session) double-subscribes and double-counts.

## Proposed fix
Add a `List` helper on the base `ViewModel` (`lib/view_models/view_model.dart:7-29`) with cancellation wired into `clear()`/`dispose()`; convert all card view-models to register subscriptions there; close the heart-rate `StreamGroup`.

## Acceptance criteria
- [ ] `init(); clear(); init();` yields exactly one active subscription per stream (unit test)
- [ ] No `.listen(` in a card view-model outside `init()`

**Effort:** M · **Priority:** P1 · **Change risk:** Low