add firestore terraform

Assists people who want to self-host and need particular firestore config

go/firestore.rules

@@ -0,0 +1,19 @@
+rules_version = '2';
+service cloud.firestore {
+  match /databases/{database}/documents {
+
+    // Per-human membership mirror maintained by Orion's service account.
+    // Locked from clients so the membership list cannot leak or be mutated.
+    match /humans/{humanId} {
+      allow read, write: if false;
+    }
+
+    // Particles: caller must be a current member of the network in the path.
+    // get() on the mirror is cached across rule evaluations within a single
+    // request, so this costs 1 billed read per request regardless of query size.
+    match /networks/{networkId}/children/{particleId=**} {
+      allow read, write: if request.auth != null
+        && networkId in get(/databases/$(database)/documents/humans/$(request.auth.uid)).data.networks;
+    }
+  }
+}