[EPIC] Privacy & secrets hardening

For an app collecting health data: OAuth tokens are persisted as plaintext JSON in SharedPreferences, user objects (including tokens) are string-interpolated into logs, Android backup of those prefs is not disabled, and iOS file sharing exposes the app's documents. No hardcoded secrets were found (client ID `studies-app` at `lib/data/carp_backend.dart:51` is a public OAuth client — fine), and there is no third-party analytics (verified).

**Definition of done:** tokens in platform secure storage, logs PII-free, platform flags deliberate and documented.

Line references are against branch `chore/cams-2.x-upgrade` @ 560a181.