AUTH-001A: require verified email for role grants

[daliu]

Summary

• require Firebase Auth userRecord.emailVerified === true before member or admin promotion
• enforce the same pure policy in the authenticated admin callable and each legacy bulk-sync item before any claim or profile write
• preserve demotion, App Check/admin authorization, batch bounds, self-demotion protection, and bulk admin exclusion
• return one bounded generic bulk failure so unverified and nonexistent targets are indistinguishable

Verification

• roleGrantPolicy.test.js: 10/10 passed, including forged-field, no-write, mixed-batch, missing-target, demotion, and self-demotion cases
• full Functions tests: 3 suites / 17 tests passed
• full Functions lint: passed
• Firestore Rules emulator suite: 4 suites / 97 tests passed
• diagnostic frontend production build: passed
• diff check: passed
• independent final security re-review: approved with no residual findings

The unrelated frontend baseline still stops in App.test.jsx because TextEncoder is undefined; that pre-existing failure is claimed in #103 and this PR does not touch its files. The SPA-navigation script named in the shared working-tree instructions is not present on current main, so it could not be invoked from this isolated branch.

No production identity, provider, or configuration changes were made.

Closes #98

[netlify]

❌ Deploy Preview for luminous-fox-7c393f failed.

Name	Link
🔨 Latest commit	ece2b8e
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a53fff53ec0f40008cbaed5