Verify the foundation
Deploy the complete Firestore rules cleanly, remove duplicated lines, inspect the orders blocks and tail, confirm canvasDesigns has no client access, and prove there is no permissive catch-all.
Add Firebase emulator rules tests that prove one account cannot access another account's draft. Confirm Secret Manager and a scoped runtime service account are used instead of the default compute service account.