Prompt: fix open Firebase security rules

Audit and fix my Firestore and Storage security rules.

1. Show me the current rules and point out every rule that allows access
   without checking the caller — anything of the form
   allow read, write: if true, or a condition that is always satisfied.
2. Replace them with per-document ownership checks, for example:
     match /orders/{id} {
       allow read, update, delete: if request.auth != null
         && request.auth.uid == resource.data.userId;
       allow create: if request.auth != null
         && request.auth.uid == request.resource.data.userId;
     }
   Note that create must validate request.resource, not resource.
3. Apply the same treatment to Storage rules — buckets are missed far more
   often than collections.
4. Make sure no rule grants access based on a field the client supplies and
   can set freely.
5. Deny by default: anything not explicitly allowed should be refused.

List every collection and bucket, its rule before and after, and what an
unauthenticated caller can do with each afterwards.