CI-001D2 source: guard staging email/password Auth

[daliu]

Outcome

Adds a reviewable Firebase Auth source contract that enables only email/password and a fixed, guarded staging Auth deployment command. The provider remains uninitialized until this exact source is merged and separately deployed from main.

Refs #671.

Invariant and failure cases

• firebase.json contains only providers.emailPassword true under Auth.
• The unqualified Firebase alias remains demo-mprc-local.
• The deploy command is pinned to the committed Firebase CLI, Auth-only scope, and run-mprc-staging.
• Predeploy requires the exact cloud and quota project, runmprc@gmail.com declaration, a short-lived token, and no ADC file override.
• Anonymous, Google, phone, production/other projects, broader scope, wrong account declaration, missing token, and ADC override fail closed.
• CI receives no cloud credential and performs no deployment.
• No Auth provider, user, email, billing, Function, App Check, Hosting, Firestore, production, or outside-provider state changes in this pull request.

Verification

• Focused Auth contract: 5/5 passed under Node 20.19.5.
• Protected workflow and dependency safety command: 113/113 passed.
• Frontend Jest: 18 suites, 1,346/1,346 passed.
• SPA safety: 11/11 passed.
• Frontend lint baseline: 120 files, 113 reviewed legacy errors, 6 reviewed legacy warnings.
• Functions lint: passed.
• Functions tests: 69 suites passed, 7,569 passed, 64 skipped.
• Firestore Rules: 5 suites, 418/418 passed under Java 21.0.12.
• Commerce command journal emulator: 63/63 passed.
• Diagnostic optimized build: passed.
• Diff credential-shape scan: 0 matches.
• Markdown fence check: 0 failures.
• npm production audits were reviewed without applying upgrades: root has 4 known findings and Functions has 8 known moderate findings. No dependency or lockfile changed.

Compatibility and rollback

This is additive configuration and test coverage. No schema or data migration exists. Before provider deployment, rollback is one reviewed revert. After provider deployment, the follow-up provider record must define the safe rollback or roll-forward from readback; never delete users or the Firebase project as an undo test.

Officer impact: Officers gain a no-terminal way to verify that source permits only a future staging email/password Auth operation. It does not make staging sign-in usable.

Officer documentation: OFFICER_START_HERE.md; docs/officers/README.md; docs/officers/PUBLISH_AND_CHECK.md; docs/officers/SYSTEM_MAPS.md; README.md; SYSTEM_DESIGN.md; SECURITY.md; IMPLEMENTATION_PLAN.md; OPERATIONS_RUNBOOK.md; GITHUB_ISSUES.md.

Deployment evidence: Source and local tests only. Firebase Auth is still uninitialized; no user was created; billing remains disabled from the pre-change read; staging Hosting version and empty Firestore boundary are unchanged by this pull request; production Firebase, Netlify, runmprc.com, DNS, Stripe, email, and other providers were not changed or verified.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	2ee7a1c
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a8f4f1e3ba9af0007a97f26
😎 Deploy Preview	https://deploy-preview-672--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

Self-review completed on exact head 2ee7a1c.

Review findings: none.

Security and operations review:

• The Auth source has one exact provider key, emailPassword true.
• The default Firebase alias remains demo-mprc-local.
• The only committed provider command is pinned to the lockfile CLI, --only auth, and run-mprc-staging.
• The predeploy guard rejects production or other projects, broad scope, wrong account declaration, missing/short token, and ADC file override with one fixed non-echoing error.
• Hosted CI receives no Firebase/cloud credential and cannot run the provider command.
• No request body, token value, account record, user data, or raw provider error is logged.
• No schema, dependency, lockfile, Function, Rule, index, App Check, Hosting, production, email, Stripe, or outside-provider behavior changes.
• Officer and engineering docs consistently say source only and provider not initialized.
• Local Node 20/Java 21 checks passed, including 5 focused Auth tests, 113 workflow/security tests, 1,346 frontend tests, 7,569 Functions tests, 418 Rules tests, 63 commerce concurrency tests, lint, SPA checks, and build. Credential-shape scan found zero matches.

Residual risk: RUN_MPRC_FIREBASE_ACCOUNT is a fail-closed declaration, not cryptographic identity proof. The provider phase must mint the short-lived token with the explicit runmprc@gmail.com gcloud account, recheck no billing and zero users, deploy only exact merged main, read back provider and authorized-domain state, perform disposable synthetic create/sign-in/delete proof, and finish at zero users. This pull request intentionally does not claim any of that provider evidence.