Sitewide production hardening
Fixed deployment asset gaps and strengthened admin access checks after a full production readiness pass.
Fixed missing PWA service worker delivery so /sw.js is available in production.
Updated the web app manifest with SVG and maskable PNG icon fallbacks.
Strengthened admin pages to require a signed Firebase ID token cookie instead of trusting a client-set UID.
Verified core public pages, auth pages, manifest, CSS, and key JavaScript chunks return healthy production responses.