Sign-in: Firebase Auth for the board

A person at a browser signs in; an agent carries a token. The platform accepts either as the bearer — a Firebase ID token resolves to the person's roles by uid or email — so the board can use plain Firebase Auth (Google, or email and password) and never handle a tsp_… token at all.

This module is the browser-only glue, and it has no build-time dependency: the Firebase SDK is loaded on demand from Google's CDN, and the project's public web config comes from Firebase Hosting's well-known /__/firebase/init.json, with the project id read off the functions host (us-central1-<project>.cloudfunctions.net). The API key in that config is a public identifier of the project, not a secret; what protects the data is the platform's roles, resolved per request from the ID token.

If your page has a CSP: the SDK loads from https://www.gstatic.com (firebasejs/<FIREBASE_SDK_VERSION>) and the config from https://<project>.web.app; allow both as script and connect sources. No unsafe-eval is needed. SDK supply chain (a compromised CDN) is out of scope here, as it is for any page that loads Firebase this way.

Sessions persist the way Firebase Auth persists them (this browser, until sign-out), and ID tokens refresh themselves — the client asks for a fresh one on every request. Sign-in domains other than localhost and the project's own hosting must be authorized in the Firebase console.