Firebase user can take over another user's document

`allow update: if request.resource.data.uid == request.auth.uid` looks like owner binding, but it checks the value the writer supplies themselves. The question “am I the new owner?” is always yes — the rule protects nothing.

For `create` this exact form is correct (you create your own document). For `update` it is a takeover: a signed-in user writes to someone else's document, sets `ownerId`/`uid` to themselves and satisfies the condition. Any foreign record can be hijacked — seen in the field on a combined `allow create, update` rule.

Fix: in the `update` rule check the EXISTING owner (`resource.data.ownerId == request.auth.uid`) and pin the field to its previous value. Separate `create` and `update`, because they need different checks.