Remove READ_MEDIA_IMAGES permission to comply with Google Play policy

[Copilot]

This PR removes the android.permission.READ_MEDIA_IMAGES permission from the Android manifest to comply with Google Play's Photo and Video Permissions policy.

Issue

Google Play flagged the app for using undeclared photo and video permissions, specifically READ_MEDIA_IMAGES, and requested justification for its usage or migration to the Android photo picker.

Analysis

After thorough code analysis, I found that:

• The app only captures photos/videos using the camera and saves them to the public gallery
• While photo picking functionality exists in the codebase (CameraService.pickPhoto()), it is not exposed in any UI components
• No user-facing features allow browsing or selecting from the device's existing photo library
• The permission was added preemptively but is not actually needed for the app's current functionality

Changes

• Removed android.permission.READ_MEDIA_IMAGES permission declaration from android/app/src/main/AndroidManifest.xml
• All essential camera permissions (CAMERA, WRITE_EXTERNAL_STORAGE) remain intact
• No code changes needed as the unused photo picking functionality can remain for potential future use

Validation

• AndroidManifest.xml validated as correct XML
• Confirmed READ_MEDIA_IMAGES permission successfully removed
• Verified all 16 other permissions remain present and correct

This minimal change addresses Google Play's policy requirements while maintaining all existing app functionality.

Fixes #3339.

Warning

Firewall rules blocked me from connecting to one or more addresses

I tried to connect to the following addresses, but was blocked by firewall rules:

• dl.google.com
  • Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-opens=java.base/java.nio.charset=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.xml/javax.xml.namespace=ALL-UNNAMED -Xmx1536m -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en -Duser.variant -cp /home/REDACTED/.gradle/wrapper/dists/gradle-8.11.1-all/2qik7nd48slq1ooc2496ixf4i/gradle-8.11.1/lib/gradle-daemon-main-8.11.1.jar -javaagent:/home/REDACTED/.gradle/wrapper/dists/gradle-8.11.1-all/2qik7nd48slq1ooc2496ixf4i/gradle-8.11.1/lib/agents/gradle-instrumentation-agent-8.11.1.jar org.gradle.launcher.daemon.bootstrap.GradleDaemon 8.11.1 (dns block)
• npm.pqina.nl
  • Triggering command: npm install (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to my firewall allow list

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.