🔒 Secure Firestore Rules for Statuses

[Salint]

🎯 What: The vulnerability fixed

This PR addresses insecure Firestore rules for the statuses collection where any authenticated user could create, update, or delete any status document.

⚠️ Risk: The potential impact if left unfixed

Without these changes, a malicious authenticated user could:

1. Create status documents on behalf of other users (spoofing).
2. Modify existing statuses of other users.
3. Delete statuses belonging to other users.

🛡️ Solution: How the fix addresses the vulnerability

1. Firestore Rules: Updated firestore.rules to ensure that for create, update, and delete operations, the userId field in the document matches the uid of the authenticated user.
2. Cloud Function: Since direct updates are now restricted to owners, a new viewStatus Cloud Function was added to safely allow other users to mark a status as viewed by appending their UID to the viewedBy array.
3. App Integration: Updated the StatusRepository to use the new Cloud Function for marking statuses as viewed, ensuring no loss of functionality while maintaining security.

---

PR created automatically by Jules for task 2550379534735389613 started by @Salint

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.