Document the need to update Firebase rules directly (not automated in CI)

Author: jody

.github/workflows/ci.yml

@@ -32,7 +32,13 @@ jobs:
       - name: Validate Firebase rules JSON
         run: npm run validate:rules:json
 
-      - name: Validate Firebase rules syntax
+      - name: Validate Firebase rules syntax and smoke test
+        # Validates firebase-rules.json syntax and runs behavioral smoke tests against
+        # the Firebase Database Emulator. This does NOT deploy the rules to the live
+        # Firebase project. After merging changes to firebase-rules.json, deploy manually:
+        #   npx firebase-tools deploy --only database --project YOUR_PROJECT_ID
+        # Automating deployment here would require a Firebase service-account secret in
+        # GitHub Actions — see README Step 7 for instructions.
         run: npm run validate:rules
 
       - name: Build app

README.md

@@ -155,10 +155,24 @@ VITE_INSTRUCTOR_PASSWORD=your_password_here
 
 ### Step 7 — Set Firebase security rules
 
+The file [`firebase-rules.json`](firebase-rules.json) defines who can read and
+write each part of the database.
+
 1. Firebase Console → **Realtime Database → Rules** tab
 2. Replace everything with the contents of [`firebase-rules.json`](firebase-rules.json)
 3. Click **Publish**
 
+Note that the CI pipeline valideas the rules but does not deploy them automatically.
+Whenever the rules change, they must be deployed to the Firebase project directly.
+
+To do this from the Firebase CLI:
+```bash
+npx firebase-tools login
+npx firebase-tools deploy --only database --project YOUR_PROJECT_ID
+```
+Replace `YOUR_PROJECT_ID` with the Firebase project ID from your `.env.local`
+(`VITE_FIREBASE_PROEJCT_ID`).
+
 ### Step 8 — Test locally
 
 ```bash