refactor(admin): remove hardcoded email and dynamically resolve admin privileges via Firestore Admins collection

firestore.rules

@@ -10,7 +10,8 @@ service cloud.firestore {
     function isAdmin() {
       return request.auth != null && (
         request.auth.token.admin == true ||
-        request.auth.token.email == 'nicolas@gruber.info'
+        exists(/databases/$(database)/documents/Admins/$(request.auth.uid)) ||
+        (request.auth.token.email != null && exists(/databases/$(database)/documents/Admins/$(request.auth.token.email)))
       );
     }
 
@@ -22,6 +23,12 @@ service cloud.firestore {
       );
     }
 
+    // Admins-Sammlung: Angemeldete Nutzer können prüfen, nur Admins schreiben
+    match /Admins/{adminDoc} {
+      allow read: if isAuthenticated();
+      allow write: if isAdmin();
+    }
+
     // Öffentliche Sammlungen: News, Mängel (Issues) & Ideen (CitizensForum)
     match /{collection}/{document=**} {
       // Jeder darf News, Mängel & Ideen öffentlich lesen