Docker-backed E2E fails locally + on CI: API routes use client Firestore SDK, hit rules without auth