fix(firebase): gate google-services.json with committed template (E01.S01)

[abdout]

Story: E01.S01 (Phase 1 Pilot v1, Sprint P1)
Epic: EPIC-PROD-01 Foundation Hardening
Points: 2

Problem

app/google-services.json is gitignored. A fresh checkout fails AGP's :app:processDebugGoogleServices task because the file doesn't exist — a known blocker called out in epic-prod-overview.md (10 silent stubs, item 5).

Fix

Implements the AC's "Option B" gate (the AC explicitly allows this when license/security forbids committing real Firebase config — which is the right call here):

• Commit app/google-services.json.template with stub but structurally valid values. AGP's parser accepts it; processGoogleServices succeeds; runtime Firebase calls fail loudly via AppStartupInitializer.confirmFirebase (E01.S07) instead of silently no-op'ing
• Add a Gradle configuration-time hook in app/build.gradle.kts that materialises app/google-services.json if missing:
  1. Honor -Pfirebase.config.path=/abs/path if provided (CI + developers with real creds)
  2. Otherwise copy from the template with a warning log
  3. Hard-fail with an actionable error if neither exists
• app/google-services.json stays gitignored — real Firebase config never enters version control
• README section under "Getting Started" documents both setup paths

Acceptance criteria

• Fresh checkout → ./gradlew :app:processDebugGoogleServices succeeds with no manual file placement
• -Pfirebase.config.path=/abs/path overrides the template
• app/google-services.json remains gitignored (template is the only file in version control)
• README documents both setup paths

Deferred (out of P1 scope)

• "Staging and release flavors point to separate Firebase projects" AC bullet — the app has no staging productFlavor today; adding flavors is a larger refactor. Template covers org.hogwarts.android (release) + org.hogwarts.android.debug (debug). Staging flavor folds into E27 release pipeline work in Phase 2.

Source: .bmad/epics/epic-prod-01-foundation-hardening.md