Fix data exposure via Android backup by adding proper exclusion rules (#339)

This commit addresses issue #257 (SEC-04) where `allowBackup="true"` was enabled but the extraction rules files had empty templates, exposing sensitive database and shared preferences files.

Changes made:
- Updated `AndroidManifest.xml` to include `android:dataExtractionRules` and `android:fullBackupContent` on the `<application>` element.
- Updated `res/xml/backup_rules.xml` and `res/xml/data_extraction_rules.xml` to specifically exclude the Room database (`hermes_control.db`) and EncryptedSharedPreferences file (`hermes_secure_prefs.xml`) from both cloud backup and device transfer operations.

Reasoning:
This prevents extraction of these sensitive files via `adb backup` or Google cloud backups on both legacy and API 31+ devices, mitigating a high-severity security vulnerability without breaking legitimate application backup capabilities.

Impact:
This secures the sensitive app data. No functional changes to the codebase logic were made.

Fixes #257

app/src/main/AndroidManifest.xml

@@ -10,6 +10,8 @@
     <application
         android:name=".HermesControlApp"
         android:allowBackup="true"
+        android:dataExtractionRules="@xml/data_extraction_rules"
+        android:fullBackupContent="@xml/backup_rules"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
         android:roundIcon="@mipmap/ic_launcher_round"

app/src/main/res/xml/backup_rules.xml

@@ -6,8 +6,6 @@
    See https://developer.android.com/about/versions/12/backup-restore
 -->
 <full-backup-content>
-    <!--
-   <include domain="sharedpref" path="."/>
-   <exclude domain="sharedpref" path="device.xml"/>
--->
+    <exclude domain="database" path="hermes_control.db" />
+    <exclude domain="sharedpref" path="hermes_secure_prefs.xml" />
 </full-backup-content>

app/src/main/res/xml/data_extraction_rules.xml

@@ -5,15 +5,11 @@
 -->
 <data-extraction-rules>
     <cloud-backup>
-        <!-- TODO: Use <include> and <exclude> to control what is backed up.
-        <include .../>
-        <exclude .../>
-        -->
+        <exclude domain="database" path="hermes_control.db" />
+        <exclude domain="sharedpref" path="hermes_secure_prefs.xml" />
     </cloud-backup>
-    <!--
     <device-transfer>
-        <include .../>
-        <exclude .../>
+        <exclude domain="database" path="hermes_control.db" />
+        <exclude domain="sharedpref" path="hermes_secure_prefs.xml" />
     </device-transfer>
-    -->
 </data-extraction-rules>