Secure manual Firestore setup rules

[qayshp]

Summary

• replace the manual setup's globally open Firestore rule with the scoped rules installed by the server's automatic Firebase setup
• allow unauthenticated reads only for server/config and unauthenticated writes only for server/commands
• explain default denial for unmatched paths, the service-account Admin SDK bypass, and the remaining public access boundary
• link the server implementation that is the source of truth for the policy and require maintainers to compare the two when either changes

Why

The written manual setup currently instructs users to change Firebase's default rule to allow read, write: if true;. That exposes every Firestore document to unauthenticated reads and writes. The server's automatic setup already uses a narrower rule set, but the manual guide never adopted it.

User impact

New manual-setup users will grant only the two client operations BlueBubbles needs instead of opening the entire database. Existing users can also replace their permissive rule with the documented rule. This limits exposure but does not authenticate the two public client operations.

Coordination

PR #31 edits the database-creation steps on the same page for a separate issue. Merge simulations pass with #31 and #34 applied in either order, and the combined result preserves both changes.

Validation

• git diff --check origin/master...HEAD passes
• the documented rules are byte-for-byte identical to FCMService.setFirestoreRulesForApp on current server master and development
• a local Firestore Emulator access matrix passed for the documented policy: public config read and commands write were allowed; the inverse operations and unmatched-path reads/writes were denied
• the old globally open rule no longer appears in this branch

The emulator test did not read or modify a production Firebase project. No production deployment was performed or required.

Fixes BlueBubblesApp/bluebubbles-server#783

[qayshp]

Self-review focused on keeping the manual rule safe as the server evolves.

[qayshp]

Validation update

• git diff --check origin/master...HEAD passes.
• The documented rules remain byte-for-byte identical to the rules currently installed by FCMService.
• The rules passed a local Firestore Emulator access matrix:
  • unauthenticated server/config read: allowed (404 because the test document did not exist)
  • unauthenticated server/config write: denied (403)
  • unauthenticated server/commands write: allowed (200)
  • unauthenticated server/commands read: denied (403)
  • unmatched-path read and write: denied (403)

The test used only the local emulator and did not read or modify a production Firebase project.

This page overlaps PR #31. Any rebase or conflict resolution must preserve both #31's live-validated database-creation labels and this PR's scoped rules.

[qayshp]

Merge-readiness update: 8e7bbad adds a direct policy source-of-truth link and maintenance instruction. The documented rule is byte-for-byte identical to current server master and development; the recorded emulator access matrix remains applicable because the rule bytes are unchanged. Structural checks pass, and merge simulations with PR #31 pass in both orders. No production Firebase state was touched.