chore(privacy): decide at-rest posture for cached health-data JSON

## Problem
(verified) Card view-models persist their data models as plaintext JSON in the cache dir every 3 minutes (`lib/view_models/view_model.dart:79-82`, `:119-131`). OS-level encryption (iOS Data Protection, Android FBE) applies, so this is defensible — but it should be a documented decision, especially combined with the iOS file-sharing flags. Cleanup on leave-study already works (`lib/blocs/app_bloc.dart:524`; `view_model.dart:93-99`).

## Proposed fix
Document accepted risk relying on platform encryption + fixed file-sharing flags, or encrypt the cache files if a study's DPIA requires it.

## Acceptance criteria
- [ ] Decision in ADR
- [ ] If "accept risk", the iOS file-sharing flags must be off (depends on the file-sharing sub-issue)

**Effort:** S (decision) · **Priority:** P3 · **Change risk:** None