Firebase rules allow everyone

This is the Firebase counterpart to the open Supabase table. The default rules deny everything, which instantly blocks a freshly generated app — the fastest way to make it work is `allow read, write: if true`, and that is exactly what stays.

Unlike Supabase there is no second barrier: anyone who reads the project configuration from the shipped bundle — and it is always there — can talk to the database directly. No key is required.

Fix: bind every rule to `request.auth != null` AND to the owner, e.g. `allow read: if request.auth.uid == resource.data.ownerId`. Write read and write rules separately; for public content use a dedicated, deliberately open path rather than a global allow.