MEMBERS-CONTENT-001 — Build the Firebase-native members-only discounts page

[daliu]

Outcome

Replace URL secrecy with a first-party discounts page protected by verified current membership.

Scope

• Add structured discount records with title, terms, safe redemption instructions, expiry, source owner, last-reviewed time, and status.
• Enforce reads through deployed Firestore Rules or a verified server projection; writes are server/scoped-admin only.
• Add a member route with loading, anonymous sign-in return, pending/unverified, expired/demoted, and authorized states.
• Keep the route noindex and out of the sitemap; ensure content never enters the static bundle, analytics, errors, or logs.
• Migrate approved content, then archive/unpublish the Google Site or retain it owner-only.
• Remove the raw arbitrary-HTML pattern from this path.

Acceptance criteria

• Anonymous, unverified, expired/demoted, and ordinary signed-in users cannot read discount documents by direct SDK/API access.
• Verified current members and explicitly authorized content admins receive only intended fields.
• Writes, unmatched paths, and raw HTML are denied or safely handled with positive/negative tests.
• Demotion/revocation propagation and maximum stale-access interval are documented and tested.
• Expired discounts disappear automatically or through an audited review process.
• No discount content appears in source, sitemap, analytics, logs, or error output.

Dependencies

Coordinating backlog SEC-001, AUTH-001, AUTH-002, and ADMIN-001. Builds on completed issue #77.

Official references

• https://firebase.google.com/docs/auth/admin/custom-claims
• https://firebase.google.com/docs/rules/rules-and-auth
• https://firebase.google.com/docs/auth/admin/manage-sessions

Coordination

Parent: #79

Do not begin implementation until dependencies are complete, this issue is assigned, and a timestamped CLAIMED comment naming the agent and branch is posted. Creation of this ticket is not a claim. Preserve the parallel agent work tracked by stable IDs in GITHUB_ISSUES.md.

[daliu]

PRODUCTION UX DEPENDENCY (2026-07-12): protected discounts must consume #109's simple email-or-Google entry and #96's validated return routing. Anonymous members should see one clear sign-in action that offers both methods, then return to the exact discounts route; email and Google users receive identical loading/pending/unverified/expired/member states. Auth-provider choice never changes discount eligibility, and no discount data may load before the server-authoritative membership gate passes.