• clusters/{cluster_X} — saved by your bot on ready
• servers/{guildId} — saved by your bot on ready/join/leave
• events/{autoId} — (optional) your bot can append status/events
• commands/{autoId} — dashboard writes here, bot executes & marks status
• admins/{uid} — whitelist for console access

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    function isAdmin() {
      return exists(/databases/$(database)/documents/admins/$(request.auth.uid));
    }
    match /clusters/{id} { allow read: if request.auth != null; allow write: if false; }
    match /servers/{id}  { allow read: if request.auth != null; allow write: if false; }
    match /events/{id}   { allow read: if request.auth != null; allow write: if isAdmin(); }
    match /commands/{id} {
      allow read:  if isAdmin();
      allow write: if isAdmin();
    }
    match /admins/{id}   { allow read, write: if isAdmin(); }
  }
}