Firestore collections anonymously readable

Firestore is the Firebase counterpart to the open Supabase table and at least as commonly affected. The default rules deny everything, which instantly blocks a freshly generated app — the fastest way to make it work is `allow read, write: if true`, and that is exactly what stays.

We do not guess collection names: only what the app names in its own bundle is checked. The query limits the response to document names; contents are never read. If a response still comes back, the rules permit anonymous reads.

Fix: bind rules per collection to identity (`request.auth.uid == resource.data.userId`), test them against an anonymous call in the Firebase rules playground, then scan again.