test: cover members-only Firestore access rules

[daliu]

Summary

• add direct security-rules coverage for the private members_only collection
• verify anonymous and unverified users are denied read access
• verify members and admins can read
• verify anonymous, no-role, unverified, and member users cannot create, update, or delete private content

Validation

• npm run test:rules (97 tests passed)
• npx eslint tests/firestore-rules/members-only.test.js
• git diff --check

Closes #77

[netlify]

❌ Deploy Preview for luminous-fox-7c393f failed.

Name	Link
🔨 Latest commit	479d208
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a53eb4dc160b300089e82b5