Automate Firestore lockdown on budget alert

[akikoiwamizu]

What and why

Switch to restrictive rules automatically if spending threshold hit.

Acceptance criteria

• Cloud Function or Run job subscribed to budget Pub/Sub
• On message, deploys firestore.rules.lockdown
• Manual test using synthetic alert verified
• Runbook added for manual revert
• Linked PR or branch