[BUG] Confirm usesCleartextTraffic is dev-only (default API is http://localhost:8000)

[karan1633]

Severity: Medium
Area: android

Problem

The Android manifest enables cleartext traffic via a build placeholder, and the default API base URL is plaintext HTTP. If the placeholder resolves to true in release builds, the template ships apps that permit unencrypted HTTP in production.

Evidence

• apps/native/android/app/src/main/AndroidManifest.xml → android:usesCleartextTraffic="${usesCleartextTraffic}"
• setup.mjs default API base URL → http://localhost:8000

Why it matters (for a starter template)

Cleartext HTTP is expected in dev but must be off in release. If the placeholder isn't gated to debug builds, derived apps silently allow plaintext network traffic.

Suggested fix

• Verify the usesCleartextTraffic manifest placeholder is true only for debug and false for release.
• Document that production must use HTTPS.

Acceptance criteria

• Release builds resolve usesCleartextTraffic to false.
• Behavior is documented for developers.