fix(android): use system photo picker

Block broad image and video read permissions in Expo config and the checked-in Android manifest. Keep picker access scoped to user-selected media and gallery saves write-only. Add regression coverage and document the release-manifest invariant.

apps/mobile/app.json

@@ -211,6 +211,10 @@
             "buildToolsVersion": "36.0.0",
             "compileSdkVersion": 36,
             "targetSdkVersion": 36,
+            "blockedPermissions": [
+              "android.permission.READ_MEDIA_IMAGES",
+              "android.permission.READ_MEDIA_VIDEO"
+            ],
             "extraProguardRules": "-keep class com.facebook.hermes.unicode.** { *; }",
             "useLegacyPackaging": false,
             "manifestPlaceholders": {