docs: audit Android manifest permissions

[jjoonleo]

Summary

• Closes [Release] Audit Android manifest permissions for release #442
• References parent track [Release Track] Android permissions and alarm policy #465
• Adds an Android manifest permission audit documenting app-owned release permissions and dependency-owned merged permissions.
• Links the audit from the release checklist and records the [Release] Audit Android manifest permissions for release #442 implementation plan under plans/.

Verification

• flutter pub get: passed
• gradle :app:processDebugMainManifest: failed before manifest output because generated Dart files are absent in this checkout
• gradle :app:processDebugMainManifest -x :app:compileFlutterBuildDebug: passed
• ANDROID_KEYSTORE_PATH=$HOME/.android/debug.keystore ANDROID_KEYSTORE_PASSWORD=android ANDROID_KEY_ALIAS=androiddebugkey ANDROID_KEY_PASSWORD=android gradle :app:processReleaseMainManifest -x :app:compileFlutterBuildRelease: passed with ignored local placeholder Firebase config for manifest merge only
• rg -n "uses-permission" build/app/intermediates/merged_manifest/release/processReleaseMainManifest/AndroidManifest.xml: confirmed merged release permission inventory
• git diff --check: passed

Unblocks

• Partially unblocks [Release] QA alarm and notification flows on Android #457 once [Release] Verify notification permission UX #443, [Release] Verify exact alarm permission UX #444, and [Release] Build a signed release Android App Bundle #452 are also complete.

[github-actions]

Visit the preview URL for this PR (updated for commit d173240):

https://ontime-c63f1--pr470-codexd-442-audit-and-1w78620v.web.app

_{(expires Sat, 16 May 2026 14:17:06 GMT)}

_{🔥 via Firebase Hosting GitHub Action 🌎}

_{Sign: 7d60a2eae4c4a5839220ed6a57552a3b61cce5a3}

[github-actions]

Visit the preview URL for this PR (updated for commit d173240):

https://on-time-front-widgetbook--pr470-codexd-442-audit-and-alc109pt.web.app

_{(expires Sat, 16 May 2026 14:17:41 GMT)}

_{🔥 via Firebase Hosting GitHub Action 🌎}

_{Sign: e53128a376fed0209d449279de9c0d94c83cdd8b}