What it actually costs, why an idle session keeps spending, and the security model underneath every permission prompt — including the sentence about what it does not protect you from.