feat(background): implement user consent mechanism for auto-start functionality

Add auto-start consent system that requires explicit user permission before enabling background sync services. Users can now choose between silent mode (no auto-start) or background mode (15-minute sync intervals).

- Add consent service with AutoStartMode enum and storage utilities
- Create withRemoveAutoStart Expo plugin to disable Android auto-start defaults
- Integrate consent checks into JPush service, background task manager, and foreground service
- Add auto-start consent UI in notification settings with descriptive dialog
- Update privacy policy with section 8 explaining auto-start scenarios and user controls
- Change default sync mode from BATTERY_SAVER to DISABLED
- Export reinitBackgroundService function for re-initializing after consent changes
- Merge OTA Android and iOS workflows into matrix build
- Add release signing config in withSigning plugin for Android
- Expand .dockerignore with native credential and build artifact exclusions

plugins/withRemoveAutoStart.js

@@ -0,0 +1,87 @@
+/**
+ * withRemoveAutoStart — 移除应用退出后的自启动/关联启动行为
+ * 
+ * 整改 2.2.6 APP频繁自启动和关联启动（存在风险）
+ * 
+ * 问题：以下 SDK 注册了 BOOT_COMPLETED 等 intent-filter，
+ * 导致设备重启时应用被自动唤醒：
+ *   - expo.modules.taskManager.TaskBroadcastReceiver
+ *   - expo.modules.notifications.service.NotificationsService
+ *   - androidx.work.impl.background.systemalarm.RescheduleReceiver
+ *   - androidx.work.impl.background.systemalarm.ConstraintProxy* (多个)
+ * 
+ * 本插件在 final manifest 合并阶段移除这些 intent-filter action，
+ * 从根本上消除应用退出后的自启动行为。
+ */
+
+const { withAndroidManifest } = require('expo/config-plugins');
+
+// 需要从 receivers 中移除的自启动相关 action
+const AUTO_START_ACTIONS = new Set([
+  'android.intent.action.BOOT_COMPLETED',
+  'android.intent.action.REBOOT',
+  'android.intent.action.QUICKBOOT_POWERON',
+  'com.htc.intent.action.QUICKBOOT_POWERON',
+]);
+
+function removeAutoStartActionsFromManifest(androidManifest) {
+  const app = androidManifest.manifest.application?.[0];
+  if (!app) return androidManifest;
+
+  // 处理 <receiver> 标签
+  const receivers = app.receiver || [];
+  for (const receiver of receivers) {
+    if (!receiver['intent-filter']) continue;
+
+    receiver['intent-filter'] = receiver['intent-filter'].map((filter) => {
+      if (!filter.action) return filter;
+
+      const originalCount = filter.action.length;
+      filter.action = filter.action.filter(
+        (action) => !AUTO_START_ACTIONS.has(action.$?.['android:name'])
+      );
+
+      if (filter.action.length !== originalCount) {
+        const removed = originalCount - filter.action.length;
+        console.log(
+          `[withRemoveAutoStart] 移除了 ${removed} 个自启动 action (receiver)`
+        );
+      }
+
+      return filter;
+    });
+
+    // 如果 intent-filter 中没有 action 了，移除整个 intent-filter
+    receiver['intent-filter'] = receiver['intent-filter'].filter(
+      (filter) => filter.action && filter.action.length > 0
+    );
+  }
+
+  // 移除 RECEIVE_BOOT_COMPLETED 权限声明
+  if (androidManifest.manifest['uses-permission']) {
+    const originalPerms = androidManifest.manifest['uses-permission'].length;
+    androidManifest.manifest['uses-permission'] = androidManifest.manifest[
+      'uses-permission'
+    ].filter((perm) => {
+      const name = perm.$?.['android:name'];
+      return name !== 'android.permission.RECEIVE_BOOT_COMPLETED';
+    });
+    const removedPerms = originalPerms - androidManifest.manifest['uses-permission'].length;
+    if (removedPerms > 0) {
+      console.log(
+        `[withRemoveAutoStart] 移除了 RECEIVE_BOOT_COMPLETED 权限声明 (${removedPerms} 处)`
+      );
+    }
+  }
+
+  return androidManifest;
+}
+
+function withRemoveAutoStart(config) {
+  return withAndroidManifest(config, (config) => {
+    config.modResults = removeAutoStartActionsFromManifest(config.modResults);
+    return config;
+  });
+}
+
+module.exports = withRemoveAutoStart;

plugins/withSigning.js

@@ -35,7 +35,95 @@ const withSigning = (config, options = {}) => {
     },
   ]);
 
+  config = withDangerousMod(config, [
+    'android',
+    async (config) => {
+      const platformRoot = config.modRequest.platformProjectRoot;
+      const buildGradlePath = path.join(platformRoot, 'app', 'build.gradle');
+
+      if (!fs.existsSync(buildGradlePath)) return config;
+
+      let lines = fs.readFileSync(buildGradlePath, 'utf-8').split('\n');
+
+      // 1. Add release signing config that reads from gradle.properties
+      const hasReleaseSigning = lines.some((l) => l.includes('MYAPP_UPLOAD_STORE_FILE'));
+      if (!hasReleaseSigning) {
+        // Find the debug signingConfig closing brace and insert release after it
+        let debugBraceLine = -1;
+        let inSigningConfigs = false;
+        let braceDepth = 0;
+
+        for (let i = 0; i < lines.length; i++) {
+          const line = lines[i];
+          if (line.includes('signingConfigs {') || line.match(/^\s*signingConfigs\s*\{/)) {
+            inSigningConfigs = true;
+            braceDepth = 1;
+            continue;
+          }
+          if (inSigningConfigs) {
+            braceDepth += (line.match(/\{/g) || []).length;
+            braceDepth -= (line.match(/\}/g) || []).length;
+            if (braceDepth === 0) {
+              debugBraceLine = i; // This is the closing } of signingConfigs
+              break;
+            }
+          }
+        }
+
+        if (debugBraceLine > 0) {
+          const releaseBlock = [
+            '        release {',
+            "            if (project.hasProperty('MYAPP_UPLOAD_STORE_FILE')) {",
+            '                storeFile file(MYAPP_UPLOAD_STORE_FILE)',
+            '                storePassword MYAPP_UPLOAD_STORE_PASSWORD',
+            '                keyAlias MYAPP_UPLOAD_KEY_ALIAS',
+            '                keyPassword MYAPP_UPLOAD_KEY_PASSWORD',
+            '            }',
+            '        }',
+          ];
+          lines.splice(debugBraceLine, 0, ...releaseBlock);
+        }
+      }
+
+      // 2. Change release buildType to use release signingConfig
+      // Walk through buildTypes > release and replace signingConfigs.debug -> signingConfigs.release
+      let inBuildTypes = false;
+      let inRelease = false;
+      let buildTypesDepth = 0;
+
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (line.includes('buildTypes {') || line.match(/^\s*buildTypes\s*\{/)) {
+          inBuildTypes = true;
+          buildTypesDepth = 1;
+          continue;
+        }
+        if (inBuildTypes) {
+          buildTypesDepth += (line.match(/\{/g) || []).length;
+          buildTypesDepth -= (line.match(/\}/g) || []).length;
+
+          if (line.match(/^\s*release\s*\{/)) {
+            inRelease = true;
+          }
+
+          if (inRelease && line.includes('signingConfig signingConfigs.debug')) {
+            lines[i] = line.replace('signingConfig signingConfigs.debug', 'signingConfig signingConfigs.release');
+            inRelease = false;
+          }
+
+          if (buildTypesDepth === 0) {
+            inBuildTypes = false;
+            inRelease = false;
+          }
+        }
+      }
+
+      fs.writeFileSync(buildGradlePath, lines.join('\n'));
+      return config;
+    },
+  ]);
+
   return config;
 };
 
-module.exports = withSigning;
+module.exports = withSigning;