Firebase email enumeration protection readiness

[Odzen]

Replaces old issue #899.

Problem

Firebase recommends enabling email enumeration protection. Before enabling it for the project, we need to confirm the app does not depend on APIs or flows that break when protection is enabled.

Current code observations

• The frontend does not appear to use fetchSignInMethodsForEmail.
• Login, registration, verification, and password reset flows still need end-to-end testing with protection enabled in a staging Firebase project.

Required behavior

• Audit Firebase client and admin usage for enumeration-sensitive APIs.
• Test login, apply/build-profile, email verification, forgot password, and admin email/password edit flows in staging.
• Enable protection only after affected flows are verified.

Acceptance criteria

• Documented staging test results for the main auth flows.
• Any broken flow is fixed before production enablement.
• Firebase protection is enabled in production or an explicit blocker is recorded.