docs(android): note explicit network security config for cleartext posture

Record that the app's HTTPS-only-in-release / HTTP-in-debug rule (ServerUrl,
allowInsecureHttp = BuildConfig.DEBUG) is backed at the platform socket layer
by an explicit network security config: main/release forbids all cleartext, a
debug override re-permits cleartext to loopback only. Matches the fix in
RunicGateway/Android-app (fix/manifest-cleartext-traffic).

Co-Authored-By: Claude <noreply@anthropic.com>

android/PLAN.md

@@ -491,7 +491,13 @@ compiled in.
   `/public/settings` for branding: name/colors/logo). Only on a successful, well-formed response is
   the URL persisted to DataStore and the app allowed to initialize its main UI.
   - Accept `https://host[/base]`; normalize/trim; require HTTPS in release builds (allow HTTP only in
-    debug for local dev against `127.0.0.1:3000`).
+    debug for local dev against `127.0.0.1:3000`). This app-layer rule (`ServerUrl`,
+    `allowInsecureHttp = BuildConfig.DEBUG`) is backed at the platform socket layer by an explicit
+    **network security config** (`res/xml/network_security_config.xml`, wired via
+    `application android:networkSecurityConfig`): the main/release config permits **no** cleartext,
+    and a debug-only override (`app/src/debug/res/xml/`) re-permits cleartext to loopback
+    (`127.0.0.1`/`localhost`) only. Being explicit also stops a merged library manifest from
+    re-enabling cleartext and clears the `usesCleartextTraffic`-implicitly-enabled scanner finding.
   - Failure states: unreachable, non-2xx, not-a-Runic-Gateway-site (missing expected `/public/status`
     shape), TLS error — each gets a clear retry message. Nothing else in the app runs until this
     succeeds.