fix(learn): nothing of Learn's goes to Android's backup or to another phone (ADR 0019, D9)

The device keeps private studysets open in its database, which Android's
backup (Google's, or Seedvault where turned on) and a transfer to a new
phone took open. allowBackup and fullBackupContent are off, and from
Android 12 on the data extraction rules exclude every folder from the
transfer too, which allowBackup alone no longer stops.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0019-private-studysets.md

@@ -404,3 +404,19 @@ Residual risks, as they stand:
 - **Tag links aren't signed:** the instance can link a private tag to an
   item of a studyset being published; the Publish sheet shows every name
   before it goes.
+
+## Android's backup (30 Oct 2026, the developer's)
+
+- **D9 Nothing of Learn's in a backup or a transfer to another phone**, as Halkyon
+  Train's ADR 0030, D53, has it: the device keeps a private studyset open in its
+  local database (D1 seals it on the way to the instance, not on the device), so
+  Android's backup (Google's, or Seedvault on GrapheneOS and other AOSP systems,
+  where the person turned it on) and a transfer to a new phone took it open, beyond
+  what sealing guards. `allowBackup` and `fullBackupContent` are off, which stops
+  both through Android 11; from Android 12 on `allowBackup="false"` stops the backup
+  alone, so `res/xml/data_extraction_rules.xml` excludes every folder from the
+  transfer too (`test/app/android_backup_test.dart`, run with the app's tests). What
+  a new phone lacks comes back from the instance as the person signs in; what is the
+  device's alone starts afresh there: its settings, a timer running, the Japanese
+  dictionaries, the Jellyfin sign-in and `privacy.json`, which a new device never had
+  either (the residual risks above).