Who's calling, and what can they do? gRPC identity and access with Firebase

I was building a budgeting and expense tracking Flutter app on iOS, Android, and web, talking to a custom Java gRPC backend. Firebase Auth handled sign-in, and on the client it worked exactly as adver