security(firestore): fix broken access control on admin key

[codewithakshyaaa]

Description

We identified a critical security vulnerability (broken access control) where unauthenticated users could access the superadmin_keys and admin_keys Firestore collections directly via the frontend client SDK. This allowed anyone to query the secret registration keys via the browser console and use them to gain unauthorized administrative privileges.

Solution Implemented
To resolve this vulnerability and decouple client-side verification from our core database infrastructure, the following structural changes were made:

Firestore Rules Fixed: Updated firestore.rules to reject public reads (allow read: if isSuperAdmin();) on both key collections. This completely blocks unauthorized client-side queries via the Client SDK.

Centralized Admin Auth SDK: Updated the backend Firebase Admin utility loader to export a secure getAuth instance alongside getFirestore.

Migration to Custom Claims: Refactored the CLI seed scripts and verification logic away from the vulnerable Firebase Client SDK over to the Firebase Admin SDK. Privileges are now assigned via cryptographically secure Custom User Claims (superadmin: true), completely removing raw database key exposures.

Normalized Claim Structure: Standardized the custom claim payload structure to use superadmin (without underscores) to guarantee a 1:1 match with the dynamic lookup functions inside our production security rules.
Fixes #323

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

• Local testing
• Vercel Preview Deployment

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings or errors
• I have checked that the "DevPath India" branding remains intact

[codewithakshyaaa]

hey @Aditya948351 kindly review this PR.

[Aditya948351]

Crucial security fix for the admin config. Thanks for patching this up securely.

[codewithakshyaaa]

Crucial security fix for the admin config. Thanks for patching this up securely.

thankyou sir. kindly merge

[Aditya948351]

Do star the repo! Successfully merging this and loved the changes you did.

[codewithakshyaaa]

thankyou sir. @Aditya948351