Create the first administrator at /sign-in as soon as deployment finishes and before sharing the website link. After setup, new visitors can only sign in.
Test Firestore and Storage rules before accepting real orders. Firebase App Check is optional.