feat: Configure CODEOWNERS and standard PR Template

.github/CODEOWNERS

@@ -0,0 +1,5 @@
+# RescueAI Code Owners
+# The last matching rule takes precedence, so we combine all required reviewers onto a single global rule.
+
+# All PRs will automatically request reviews from both the Approvers and the Code Reviewers groups.
+* @developeradhi @jeevanhso6 @suhashoskere @theakashr @theakshath @developerakashp

.github/pull_request_template.md

@@ -0,0 +1,30 @@
+## ?? RescueAI Pull Request
+
+### ?? Description
+<!-- Describe your changes in detail. Explain the problem it solves or the feature it adds to RescueAI. -->
+
+
+### ??? Changes Made
+- [ ] Added/Updated Offline Modules (Mesh Chat, FM Radio, etc.)
+- [ ] Emergency Triage / AI Backend Updates
+- [ ] UI/UX Improvements
+- [ ] Security Enhancements (Rules, Tokens, Passwords)
+- [ ] Bug Fixes
+- [ ] Other: _____
+
+### ?? Testing & Verification
+<!-- How did you test these changes? Did you verify them in offline mode? -->
+- [ ] Tested locally via 
+pm run dev
+- [ ] Passed production build check 
+pm run build
+- [ ] Verified Firebase Rules / Access Controls
+
+### ????? Review & Approval Checklist
+- [ ] **Requires 1 Final Approval** from: @developeradhi, @jeevanhso6, or @suhashoskere
+- [ ] **Requires 1 Code Review** from: @theakashr, @theakshath, or @developerakashp
+- [ ] Copilot Auto-PR has been reviewed and verified by a human.
+
+### ?? Related Issues
+<!-- Link to any related issues (e.g., Fixes #123) -->
+

firestore.rules

@@ -1,20 +1,65 @@
 rules_version = '2';
 service cloud.firestore {
   match /databases/{database}/documents {
+
+    // Helper functions
+    function isAuthenticated() {
+      return request.auth != null;
+    }
+    function isOwner(userId) {
+      return isAuthenticated() && request.auth.uid == userId;
+    }
+    // In the absence of custom claims, we securely verify their role document
+    function hasRole(role) {
+      return isAuthenticated() && get(/databases/$(database)/documents/users/$(request.auth.uid)).data.role == role;
+    }
+    function isAnyAdmin() {
+      return hasRole('global_admin') || hasRole('rescue_admin');
+    }
 
     // Users Collection Rule
     match /users/{userId} {
-      allow read, create, update, write, delete: if true;
+      allow read: if isAuthenticated();
+      // Allow users to create their own profile, but they CANNOT self-assign admin roles securely here.
+      // Firebase Cloud Functions should ideally set admin roles. For this client-side architecture, 
+      // they can create, but only admins can update roles.
+      allow create: if isOwner(userId);
+      allow update: if isOwner(userId) || isAnyAdmin();
+      allow delete: if hasRole('global_admin');
     }
 
     // Real-Time SOS Requests Collection Rule
     match /sos_requests/{requestId} {
-      allow read, create, update, write, delete: if true;
+      allow read: if isAuthenticated();
+      allow create: if isAuthenticated();
+      allow update, delete: if isAnyAdmin() || (isAuthenticated() && resource.data.userId == request.auth.uid);
     }
 
     // Legacy SOS Collection Rule
     match /sos/{docId} {
-      allow read, create, update, write, delete: if true;
+      allow read: if isAuthenticated();
+      allow create: if isAuthenticated();
+      allow update, delete: if isAnyAdmin();
+    }
+
+    // Emergency Broadcasts
+    match /emergency_broadcasts/{broadcastId} {
+      allow read: if isAuthenticated();
+      allow create, update, delete: if isAnyAdmin();
+    }
+
+    // Shelter Bookings
+    match /shelter_bookings/{bookingId} {
+      allow read: if isAuthenticated();
+      allow create: if isAuthenticated();
+      allow update, delete: if isAnyAdmin() || (isAuthenticated() && resource.data.userId == request.auth.uid);
+    }
+
+    // Audit Logs
+    match /audit_logs/{logId} {
+      allow read: if isAnyAdmin();
+      allow create: if isAuthenticated();
+      allow update, delete: if false; // Audit logs should never be modified
     }
   }
 }

frontend/next-env.d.ts

@@ -1,6 +1,5 @@
 /// <reference types="next" />
 /// <reference types="next/image-types/global" />
-/// <reference path="./.next/types/routes.d.ts" />
 
 // NOTE: This file should not be edited
 // see https://nextjs.org/docs/app/api-reference/config/typescript for more information.