Mob.Storage.exclude_from_backup/1: keep re-downloadable data out of iCloud backups (bezalel-lac.3)

[GenericJam]

Tracked as bead bezalel-lac.3 (no MOB issue: the Linear workspace has hit its free-tier issue limit).

Why

Bezalel keeps 182-607 MB of re-downloadable study packs in Mob.data_dir(), which on iOS is Documents and is backed up to iCloud. Apple rejects apps that back up data they can download again. Mob had no way to set NSURLIsExcludedFromBackupKey, and Mob.Storage's docs said nothing about :documents being backed up.

What

• Mob.Storage.exclude_from_backup(path) :: :ok | {:error, :enoent | String.t()} and Mob.Storage.excluded_from_backup?(path) :: boolean().
  • iOS: a fresh NSURL fileURLWithPath:isDirectory: then setResourceValue:@YES forKey:NSURLIsExcludedFromBackupKey / getResourceValue: (fresh URL per call, so the query reads the file system, not NSURL's cache). Files and directories; a directory's flag covers its contents.
  • Android: :ok / false, no effect. Generated apps set android:allowBackup="false"; the docs say what an app that enables backup must do (backup rules XML). No MobBridge.kt change.
  • Host (no NIF): :ok / false.
  • A missing path is {:error, :enoent} on every platform (checked in Elixir, so it matches Mob.Storage's other posix errors).
• Registered in the iOS nif_funcs table and android/jni/mob_nif.zig's table; Erlang stubs; classified as returns-promptly in nif_scheduling_completeness_test.exs.
• Docs: Mob.Storage moduledoc and guides/device_capabilities.md now say which locations are backed up, with a "Keeping downloaded data out of backups" section.

Verified

Throwaway mix mob.new nbprobe --blank --local app on this branch, probe in on_start:

• iOS simulator (iPhone 16, iOS 27.0): before=false result=:ok after=true inner=false missing={:error, :enoent}; relaunched: before=true. Host-side xattr on the container directory shows com.apple.metadata:com_apple_backup_excludeItem: com.apple.MobileBackup.
• Android emulator (API arm64): result=:ok after=false missing={:error, :enoent}; the zig NIFs built and registered.
• mix test test/mob/storage_test.exs test/mob/nif_scheduling_completeness_test.exs: 28 passed.

Review

reviewer subagent (Codex rate-limited until 5:26 PM): MERGE. Its two optional notes (Android 12+ device-to-device transfer ignores allowBackup="false"; a literal-badarg test emitting a type warning) are fixed in 8b9be6c; re-review: MERGE.

CI: green (mix_audit failed once at deps.get with "Unknown package jump_credo_checks in lockfile", a Hex fetch flake; passed on rerun).