production secret added

firestore.rules

@@ -50,6 +50,12 @@ service cloud.firestore {
       allow update: if false;
     }
 
+    // Pending donations (created before payment, confirmed via webhook)
+    match /pendingDonations/{donationId} {
+      allow create: if true;
+      allow read, update, delete: if false;
+    }
+
     // Newsletter subscribers
     match /subscribers/{subscriberId} {
       allow create: if true;