Fix Firebase init deadlock and ignore service-account keys

fs() held the lock and then called _ensure_app(), which tried to take the
same non-reentrant Lock again — deadlocking the first Firestore call (and
thus the backend's first request). Use an RLock. Verified end-to-end against
a live Firestore project: source CRUD, save_attempt, leaderboard, and the
manager overview all round-trip, and the server boots + serves.

Also gitignore *firebase-adminsdk*.json so service-account keys never commit.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/firebase.py

@@ -20,7 +20,8 @@ from .config import settings
 
 log = logging.getLogger("bima.firebase")
 
-_lock = threading.Lock()
+# Reentrant: fs() holds the lock and calls _ensure_app(), which takes it again.
+_lock = threading.RLock()
 _app: Optional[firebase_admin.App] = None
 _db = None