Commit the Firestore security rules that were never in source control

SAAS_PLAN.md's review found the actual finding underneath "no multi-tenancy":
drb-frontend reads Firestore directly from the browser (every hook in lib/
does onSnapshot(collection(db, ...))), so drb-c2-core/app/internal/auth.py
is never in that read path at all. Whatever rules were protecting calls,
incidents, and nodes had been hand-set in the Firebase console -
unversioned, unreviewed, and invisible to anyone reading this repo.

Added infra/firestore/firestore.rules: deny-by-default, with every
tenant-scoped collection (nodes, systems, calls, incidents, alert_events,
alert_rules) gated on resource.data.org_id == request.auth.token.org_id, an
org_id claim that doesn't exist yet - the next commits add it. All client
writes stay denied; c2-core's admin SDK bypasses rules and remains the sole
writer, which was already the architecture. Secret-bearing collections
(node_keys, the new enrollment_tokens) are denied to clients outright rather
than org-scoped, since nothing should ever hand a raw credential to the
browser. trips/trip_events keep their current "signed-in users can read"
shape rather than being pulled into org scoping - that feature isn't
tenant-scoped in this pass (see B7), just hidden from non-founding-org users
in the UI.

Added infra/firestore/firestore.indexes.json for the composite indexes the
org_id-scoped queries will need once the frontend hooks add the equality
filter alongside their existing orderBy/range/array-contains clauses -
without these, those queries fail at runtime with a FAILED_PRECONDITION
"index required" error rather than at review time.

Also extended internal/firestore.py's collection_where() with optional
order_by/limit_to/start_after params (SAAS_PLAN.md item 1, a stated
prerequisite for B2: scoped queries need to stay ordered and bounded, and
the existing helper could only do unordered full-collection scans).
array_contains needed no new code - it was already a pass-through op string
to FieldFilter.

None of this is live yet. Deploying rules/indexes is a manual step
(firebase deploy --only firestore:rules,firestore:indexes --project
<project-id>, from infra/firestore/) - nothing in CI does this. Until it
runs, the console-configured rules are still what's actually enforced, and
these rules reference an org_id claim no token carries yet. Deploy this
alongside (not before) the org_id-stamping commits that follow, or every
read breaks for the current single-org deployment.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

infra/firestore/firestore.rules

@@ -0,0 +1,166 @@
+// Firestore security rules — the actual tenant boundary for DRB.
+//
+// WHY THIS FILE EXISTS: drb-frontend reads Firestore directly from the
+// browser (see lib/use*.ts — onSnapshot(collection(db, ...))), so c2-core's
+// app/internal/auth.py is NOT in that read path at all. These rules are the
+// only thing standing between a signed-in stranger and every org's radio
+// traffic. Before this file existed, whatever rules were live had been
+// hand-set in the Firebase console: unversioned, unreviewed, unknown. See
+// SAAS_PLAN.md B1.
+//
+// DEPLOY IS A MANUAL, OUT-OF-BAND STEP — nothing in CI or this codebase
+// pushes these rules to Firebase:
+//   firebase deploy --only firestore:rules --project <project-id>
+// (from this directory, or point --config at infra/firestore/firebase.json
+// from the repo root). Do this before or immediately after the code that
+// starts stamping org_id ships — until these rules are live, the
+// console-configured rules are still what's actually enforced.
+//
+// MODEL: c2-core (firebase-admin SDK, server-side) bypasses these rules
+// entirely and is the sole writer for every collection below — that was
+// already the architecture (see CLAUDE.md "Auth — three distinct
+// mechanisms"). These rules therefore only need to gate READS for the
+// browser client, and can safely deny ALL client writes.
+//
+// Deny-by-default: the catch-all match at the bottom denies anything not
+// explicitly listed above it, including collections added later that
+// someone forgets to add a rule for.
+
+rules_version = '2';
+
+service cloud.firestore {
+  match /databases/{database}/documents {
+
+    function signedIn() {
+      return request.auth != null;
+    }
+
+    // Platform-level role (admin/operator/viewer) — set by drb-c2-core
+    // routers/users.py custom claims. Distinct from org_role (owner/member),
+    // which is per-organization. A platform admin can read across every org
+    // (support/debugging), mirroring internal/auth.py's require_org()
+    // ?org_id= override for the same role.
+    function isPlatformAdmin() {
+      return signedIn() &&
+        (request.auth.token.role == 'admin' || request.auth.token.admin == true);
+    }
+
+    // The org_id claim is set by POST /auth/signup (or /admin/users) at
+    // account-provisioning time. No claim => no access, by construction —
+    // this is what backs AuthProvider's no-claim guard (SAAS_PLAN.md B3):
+    // a user with no org_id claim can hold a valid Firebase session and
+    // still read nothing here.
+    function myOrgId() {
+      return request.auth.token.org_id;
+    }
+
+    function inOrg(orgId) {
+      return signedIn() && (myOrgId() == orgId || isPlatformAdmin());
+    }
+
+    function docInMyOrg() {
+      return inOrg(resource.data.org_id);
+    }
+
+    // ── Org identity ──────────────────────────────────────────────────────
+    match /organizations/{orgId} {
+      allow read: if inOrg(orgId);
+      allow write: if false; // c2-core only (POST /auth/signup, routers/org.py)
+    }
+
+    match /org_members/{uid} {
+      allow read: if signedIn() && (request.auth.uid == uid || isPlatformAdmin() ||
+        inOrg(resource.data.org_id));
+      allow write: if false; // c2-core only
+    }
+
+    // ── Tenant-scoped radio data — the whole point of this file ───────────
+    match /nodes/{nodeId} {
+      allow read: if docInMyOrg();
+      allow write: if false;
+    }
+
+    match /systems/{systemId} {
+      allow read: if docInMyOrg();
+      allow write: if false;
+    }
+
+    match /calls/{callId} {
+      allow read: if docInMyOrg();
+      allow write: if false;
+    }
+
+    match /incidents/{incidentId} {
+      allow read: if docInMyOrg();
+      allow write: if false;
+    }
+
+    match /alert_events/{alertId} {
+      allow read: if docInMyOrg();
+      allow write: if false;
+    }
+
+    match /alert_rules/{ruleId} {
+      allow read: if docInMyOrg();
+      allow write: if false;
+    }
+
+    // ── Never client-readable, org-scoped or not ───────────────────────────
+    // Secrets / credential material. Reads for these go through c2-core
+    // REST routes (which apply their own auth), never straight to Firestore.
+    match /node_keys/{nodeId} {
+      allow read, write: if false;
+    }
+
+    match /enrollment_tokens/{tokenHash} {
+      allow read, write: if false; // routers/org.py mints/lists/revokes server-side
+    }
+
+    match /org_api_keys/{keyId} {
+      allow read, write: if false; // not implemented server-side yet (DEFERRED.md) — deny regardless
+    }
+
+    // ── Platform-admin-only collections ────────────────────────────────────
+    // Listed here mainly so the deny-default catch-all's intent is explicit;
+    // these are already read/written exclusively through c2-core admin
+    // routes (require_admin_token), never straight from the browser.
+    match /audit_log/{entryId} {
+      allow read, write: if false;
+    }
+
+    match /config/{docId} {
+      allow read, write: if false;
+    }
+
+    match /bot_tokens/{tokenId} {
+      allow read, write: if false;
+    }
+
+    match /waitlist/{entryId} {
+      allow read, write: if false; // POST /waitlist writes via the admin SDK
+    }
+
+    // ── Trips (internal utility feature, not org-scoped — see
+    // [[trips-feature-intentional]] and SAAS_PLAN.md B7. Frontend hides
+    // /trips outside the founding org; these rules keep the existing
+    // "public unless flagged private" trip model working for whichever
+    // users the UI still exposes it to) ────────────────────────────────────
+    match /trips/{tripId} {
+      allow read: if signedIn();
+      allow write: if false;
+    }
+
+    match /trip_events/{eventId} {
+      allow read: if signedIn();
+      allow write: if false;
+    }
+
+    // ── Deny-by-default catch-all ──────────────────────────────────────────
+    // Anything not explicitly matched above — including collections added
+    // later without a corresponding rule — is denied. This is the guard
+    // rail: a missing rule fails closed, not open.
+    match /{document=**} {
+      allow read, write: if false;
+    }
+  }
+}