feat: support scoped read authorization

[eeee0717]

Summary

• allow callers to pass an optional read-type scope to requestAuthorization, while preserving the existing default set when omitted
• resolve quantity, category, and workout permissions consistently on iOS and Android
• report iOS read authorization request state through getRequestStatusForAuthorization, including workout data
• document Android manifest-merger removal rules and the iOS read-privacy semantics

Why

The module currently requests a fixed set of health types, so apps must prompt for data they never read. Workout authorization also cannot be checked because HKWorkoutTypeIdentifier is not mapped on either platform. On iOS, authorizationStatus(for:) reports sharing status and cannot represent read authorization; the HealthKit request-status API is the supported way to determine whether another read prompt is needed.

Compatibility

Calling requestAuthorization() without arguments keeps the current default authorization set. Android library-manifest permissions are also retained for backward compatibility; apps that need least privilege can remove unused defaults from the merged manifest as documented.

Validation

• npm run specs
• npm test -- --ci (37 tests)
• npm pack --dry-run
• Android Debug + Release unit tests via Gradle with JDK 17 / SDK 36 (127 tasks)
• iOS example Debug simulator build via xcodebuild (arm64 + x86_64)
• git diff --check