ci: deploy Firestore rules with a service account, not login:ci (#51)

The deploy-firestore-rules job has failed on every push because
FIREBASE_TOKEN was never set, so rule changes (e.g. aircraft/vessels for
node-26#9) never reached prod. Switch to a dedicated least-privilege
service account whose JSON key lives in FIREBASE_SA_KEY; login:ci tokens
are deprecated and carry their minter's full access. Key is written to
RUNNER_TEMP at 0600 and removed on exit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

infra/firestore/firestore.rules

@@ -8,13 +8,11 @@
 // hand-set in the Firebase console: unversioned, unreviewed, unknown. See
 // SAAS_PLAN.md B1.
 //
-// DEPLOY IS A MANUAL, OUT-OF-BAND STEP — nothing in CI or this codebase
-// pushes these rules to Firebase:
-//   firebase deploy --only firestore:rules --project <project-id>
-// (from this directory, or point --config at infra/firestore/firebase.json
-// from the repo root). Do this before or immediately after the code that
-// starts stamping org_id ships — until these rules are live, the
-// console-configured rules are still what's actually enforced.
+// DEPLOYED BY CI on every push to main (.gitea/workflows/deploy.yml, job
+// deploy-firestore-rules, service-account auth via the FIREBASE_SA_KEY
+// secret — server-26#51). That job is separate from the app deploy, so a
+// green app deploy does NOT mean these rules are live: check that job too.
+// Editing rules in the Firebase console is overwritten by the next push.
 //
 // MODEL: c2-core (firebase-admin SDK, server-side) bypasses these rules
 // entirely and is the sole writer for every collection below — that was