[FEATURE] Exclude app data directory from OS auto-backup (iOS + Android)

Description

Per ADR 0003 — Device-level encryption for exports, backups, and OS auto-backup, Risk 1: both iOS and Android back up an app's local files by default (iCloud Backup / Google Auto Backup) with no explicit upload action required. This quietly contradicts our "no cloud storage of medical data in MVP" position even though we've never built a cloud feature.

Exclude our data directory from OS auto-backup outright. This is independent of the export/backup feature timeline and should be done early — it's a config-level fix, not a new feature.

• Android: set android.allowBackup: false in app.json (native Expo config key, no plugin required).
• iOS: exclude data files from iCloud/iTunes backup via the NSURLIsExcludedFromBackupKey file attribute. Unlike Android, this isn't a static Info.plist/app.json setting — it has to be applied to files at write time (native module or config plugin), so confirm the right hook for our storage layer before implementing.

Acceptance Criteria

• Android: android.allowBackup set to false, verified the app is excluded from Google Auto Backup
• iOS: app's data directory/files carry NSURLIsExcludedFromBackupKey, verified excluded from iCloud/iTunes backup
• Verified on a real device (or simulator backup/restore test) for both platforms, not just config inspection
• No functional regression to existing local storage/reads
• The feature/s being implemented are covered by unit tests - If not, create tests for them on this ticket

Additional Info and Resources

• Source: 0003-device-encryption-exports-backups.md, Risk 1
• Related but out of scope for this ticket: Risk 2 (encrypted device-transfer backup/restore file) and Risk 3 (optional PDF password protection) are contingent on those features being built later.
• iOS mechanism needs a short spike to confirm the correct implementation point in an Expo managed workflow (config plugin vs. native module) since NSURLIsExcludedFromBackupKey isn't a declarative config key like Android's.

QA

• On Android, back up device to Google account, reinstall app, confirm app data is not restored/present
• On iOS, trigger iCloud backup, reinstall app, confirm app data is not restored/present
• Confirm no other app functionality (local read/write) is affected

Sources:

app.json / app.config.js - Expo Documentation
Back up user data with Auto Backup | Android Developers
Prevent your app's files from being included in iCloud Backup

Start with docs/decisions/0003-device-encryption-exports-backups.md and app.json, then trace the app's storage layer and confirm the correct iOS hook for applying NSURLIsExcludedFromBackupKey in the Expo managed workflow. Implement the Android and iOS exclusions, preserve existing local reads and writes, add or update unit tests, and verify backup and restore behavior on both platforms.