Point the org backfill at the database the app actually uses

The script initialised firebase_admin from a hardcoded gcp-key.json path and
then called a bare firestore.client(). Production has neither: the server is a
GCE instance using Application Default Credentials, and the app talks to
FIRESTORE_DATABASE=c2-server, not "(default)".

The credentials half failed loudly. The database half would not have: the
script would have scanned an empty (default) database, found nothing to
backfill, created the founding org there, and printed a clean success while the
real data stayed untenanted and invisible.

Both now read the same environment the app reads, and the chosen database is
printed before any work so a wrong one is visible in the dry run.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

drb-c2-core/scripts/backfill_org_id.py

@@ -86,10 +86,24 @@ def main() -> None:
     parser.add_argument("--dry-run", action="store_true", help="Print what would change; write nothing")
     args = parser.parse_args()
 
-    creds_path = os.getenv("GCP_CREDENTIALS_PATH", "gcp-key.json")
+    # Match app/internal/firestore.py exactly. Two ways this script diverged
-    cred = credentials.Certificate(creds_path)
+    # from the app and would have failed or, worse, half-succeeded:
+    #   * credentials — GCP_CREDENTIALS_PATH is unset in production (the server
+    #     is a GCE instance and the app uses Application Default Credentials via
+    #     the metadata server). Defaulting to a "gcp-key.json" that does not
+    #     exist made the script unrunnable there.
+    #   * database — the app talks to FIRESTORE_DATABASE (c2-server in prod),
+    #     while a bare firestore.client() talks to "(default)". That one is the
+    #     dangerous half: the script would have scanned an empty database, found
+    #     nothing to backfill, created the founding org in the wrong place and
+    #     printed a clean success.
+    creds_path = os.getenv("GCP_CREDENTIALS_PATH")
+    cred = credentials.Certificate(creds_path) if creds_path else credentials.ApplicationDefault()
     firebase_admin.initialize_app(cred)
-    db = firestore.client()
+
+    database_id = os.getenv("FIRESTORE_DATABASE", "(default)")
+    print(f"Using Firestore database: {database_id}")
+    db = firestore.client(database_id=database_id)
 
     try:
         owner = auth.get_user_by_email(args.owner_email)