fix(privacy): stop Android backup restoring optional-service consent

`android:allowBackup` was never declared, so it defaulted to true. On an
emulator, `adb uninstall` followed by `adb install` of the v3.22.2-b release
skipped onboarding entirely and every optional service — catalogs, radio/TV
streaming and GitHub update checks — came back already enabled, because
Android restored the previous install's preferences.

That makes three statements untrue: the Optional Services screen ("off until
you enable them"), docs/ORIENTATION.md ("a fresh install starts with
everything off") and the release notes ("every outbound connection sits
behind a switch that ships off"). A driver who reinstalls, or restores onto a
new head unit, gets streaming and update checking without being asked.

It also explains the runtime error seen on that first launch:
flutter_secure_storage ciphertext was restored without its Android Keystore
key, which never leaves the device — "Key mismatch detected during cipher
initialization".

Backup is now off on both paths. `allowBackup="false"` covers cloud backup on
every API level; res/xml/data_extraction_rules.xml is required as well
because on API 31+ device-to-device transfer is governed there, not by
allowBackup. Verified in the built APK: allowBackup=false and
dataExtractionRules resolving to a compiled resource.

Trade-off, taken deliberately: favorites, themes and settings no longer
migrate to a new device. They live in the same FlutterSharedPreferences file
as `optional_services.v1` and Android's backup rules are file-granular, so
consent cannot be excluded on its own. Silently inheriting consent is the
worse outcome for an app that can actuate a vehicle. Keeping migration would
mean moving the consent key into its own preferences file.

test/architecture/backup_disabled_test.dart guards it: the attribute defaults
to true when absent, so deleting the line is a silent regression rather than
a build failure.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AjhsQbfGjJw2V8j2WmRXpN

Author: i99dev

android/app/src/main/AndroidManifest.xml

@@ -153,11 +153,22 @@
     <uses-permission android:name="android.permission.READ_LOGS"
         tools:ignore="ProtectedPermissions"/>
     <uses-permission android:name="android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS"/>
+    <!-- Backup is OFF on purpose. Restoring a previous install's preferences
+         carries optional-service CONSENT (catalogs, streaming, GitHub
+         updates) onto the new install, so the driver is never shown the
+         opt-in the UI promises ("off until you enable them"). It also
+         restores flutter_secure_storage ciphertext whose Keystore key is
+         gone, which fails at runtime with "Key mismatch detected".
+         allowBackup covers cloud backup on every API level;
+         @xml/data_extraction_rules is needed as well because API 31+ governs
+         device-to-device transfer there. -->
     <application
         android:label="iLINK"
         android:name="${applicationName}"
         android:icon="@mipmap/ic_launcher"
         android:largeHeap="true"
+        android:allowBackup="false"
+        android:dataExtractionRules="@xml/data_extraction_rules"
         android:networkSecurityConfig="@xml/network_security_config">
         <!-- launchMode + taskAffinity tuning for chooser-delivered
              intents.

android/app/src/main/res/xml/data_extraction_rules.xml

@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Android 12+ (API 31+) backup/transfer policy.
+
+  Nothing this app stores may leave the device through Backup & Restore or
+  device-to-device transfer. Two reasons, both load-bearing:
+
+    1. Optional-service consent (`optional_services.v1` in
+       FlutterSharedPreferences) records whether the driver allowed catalogs,
+       radio/TV streaming and GitHub update checks. Those default to OFF and
+       the UI promises they are "off until you enable them". A restored
+       preferences file silently carries a previous grant onto a new install,
+       so the driver is never asked and the promise is broken.
+
+    2. flutter_secure_storage ciphertext is bound to an Android Keystore key
+       that is destroyed on uninstall and is NEVER part of a backup. Restoring
+       the ciphertext alone produces unreadable values and the runtime error
+       "Key mismatch detected during cipher initialization".
+
+  `android:allowBackup="false"` in AndroidManifest.xml covers cloud backup on
+  every API level; this file is required as well because on API 31+ the
+  device-transfer path is governed here rather than by allowBackup.
+
+  Consequence, accepted deliberately: favorites, themes and settings do not
+  migrate to a new device. Consent state is not something to silently inherit
+  in an app that can actuate a vehicle.
+-->
+<data-extraction-rules>
+    <cloud-backup>
+        <exclude domain="root" />
+        <exclude domain="file" />
+        <exclude domain="database" />
+        <exclude domain="sharedpref" />
+        <exclude domain="external" />
+        <exclude domain="device_root" />
+        <exclude domain="device_file" />
+        <exclude domain="device_database" />
+        <exclude domain="device_sharedpref" />
+    </cloud-backup>
+    <device-transfer>
+        <exclude domain="root" />
+        <exclude domain="file" />
+        <exclude domain="database" />
+        <exclude domain="sharedpref" />
+        <exclude domain="external" />
+        <exclude domain="device_root" />
+        <exclude domain="device_file" />
+        <exclude domain="device_database" />
+        <exclude domain="device_sharedpref" />
+    </device-transfer>
+</data-extraction-rules>

test/architecture/backup_disabled_test.dart

@@ -0,0 +1,87 @@
+import 'dart:io';
+
+import 'package:flutter_test/flutter_test.dart';
+
+/// CI gate: Android backup must stay disabled.
+///
+/// `android:allowBackup` defaults to **true** when the attribute is absent, so
+/// deleting the line is a silent regression rather than a build error. What it
+/// costs when it regresses:
+///
+///   * Optional-service consent (`optional_services.v1`) is restored from a
+///     previous install, so catalogs / streaming / GitHub updates come back ON
+///     without the driver being asked. The Optional Services screen states they
+///     are "off until you enable them"; a restore makes that untrue.
+///   * flutter_secure_storage ciphertext is restored without its Keystore key
+///     (the key never leaves the device), producing the runtime error
+///     "Key mismatch detected during cipher initialization".
+///
+/// Observed on an emulator: `adb uninstall` followed by `adb install` skipped
+/// onboarding entirely and every optional service was already enabled.
+void main() {
+  group('Android backup policy', () {
+    final manifest = File('android/app/src/main/AndroidManifest.xml');
+
+    test('manifest exists where this test expects it', () {
+      expect(
+        manifest.existsSync(),
+        isTrue,
+        reason: 'Run tests from the repository root.',
+      );
+    });
+
+    test('allowBackup is explicitly false', () {
+      final xml = manifest.readAsStringSync();
+      expect(
+        xml.contains('android:allowBackup="false"'),
+        isTrue,
+        reason:
+            'android:allowBackup must be explicitly false — the attribute '
+            'defaults to true when omitted, which restores optional-service '
+            'consent onto a fresh install.',
+      );
+      expect(
+        xml.contains('android:allowBackup="true"'),
+        isFalse,
+        reason: 'Backup must not be re-enabled.',
+      );
+    });
+
+    test('device-to-device transfer is governed by extraction rules', () {
+      // On API 31+ allowBackup alone does not stop D2D transfer.
+      final xml = manifest.readAsStringSync();
+      expect(
+        xml.contains(
+          'android:dataExtractionRules="@xml/data_extraction_rules"',
+        ),
+        isTrue,
+        reason:
+            'API 31+ governs device-to-device transfer through '
+            'dataExtractionRules, not allowBackup.',
+      );
+    });
+
+    test('extraction rules exclude every domain from both paths', () {
+      final rules = File(
+        'android/app/src/main/res/xml/data_extraction_rules.xml',
+      );
+      expect(rules.existsSync(), isTrue);
+      final xml = rules.readAsStringSync();
+
+      expect(xml.contains('<cloud-backup>'), isTrue);
+      expect(xml.contains('<device-transfer>'), isTrue);
+
+      // Both sections must exclude the domains that can hold consent or
+      // secure-storage ciphertext. Each appears once per section.
+      for (final domain in ['root', 'file', 'database', 'sharedpref']) {
+        expect(
+          '<exclude domain="$domain" />'.allMatches(xml).length,
+          2,
+          reason:
+              'domain "$domain" must be excluded from BOTH cloud-backup and '
+              'device-transfer.',
+        );
+      }
+    });
+  });
+}