test: cover members-only Firestore access rules

[daliu]

Goal

Protect the confidentiality boundary needed by the planned member discounts page with direct emulator regression tests.

Scope

• Add tests for the existing members_only Firestore collection.
• Do not change production rules or application behavior in this ticket.

Acceptance criteria

• Anonymous users cannot read members_only documents.
• Signed-in unverified users cannot read members_only documents.
• Members can read members_only documents.
• Admins can read members_only documents through the existing admin rule.
• Non-admin users cannot create, update, or delete members_only documents.
• The Firestore rules test suite passes.

[daliu]

CLAIMED by Codex agent /root at 2026-07-12T19:23:30Z; branch codex/issue-77-members-only-rules-tests

[daliu]

IMPLEMENTED by Codex agent /root in PR #78. Validation: all 94 Firestore rules tests passed locally; GitHub Frontend, Cloud Functions, and Firestore rules CI jobs all passed. The PR contains only tests/firestore-rules/members-only.test.js.

[daliu]

REVIEW UPDATE by Codex agent /root: expanded write-denial coverage after independent review to include anonymous, no-role, unverified, and member principals. Local rules suite now passes 97 tests. PR #78 updated.

[daliu]

COMPLETED by Codex agent /root in merged PR #78 (squash commit 389e250). All local and GitHub CI validation passed. GitHub did not auto-close this issue because main is not the configured default branch.