[regeloapp-coder]

Summary

• Encrypt pending cover images at rest with an AES-GCM key in Android Keystore; migrate legacy plaintext covers atomically on first upload, exclude pending images from backup/transfer, and clear files/key on sign-out and account deletion.
• Extend the per-user GDPR export to include submitted community reports and received notifications, with a regression assertion that scope and counts are user-specific.
• Add the v1.4.2 SQL migration and bump Android app version to 1.3.3 (versionCode 133).

Backend deployment

Applied supabase/2026-10-26_app_v1_4_2.sql to Supabase project pqmfezkvaslqedalwwnn. Live checks confirm the export RPC is executable by authenticated, not by anon, and its deployed definition includes both added data categories.

Validation

• git diff --check passed.
• Android backup rule XML parsed successfully.
• Android tests/build could not be run locally because Java is unavailable; CI will validate the Android code.
• The SQL RLS battery was updated but not run against production to avoid mutating live user data.