feat(backend): Implement lazy whitelisting for pool creation

[rafamiziara]

Overview

Implement backend callable function that lazy-whitelists authenticated users when they attempt to create a pool for the first time. This prevents spam while maintaining good UX.

Tasks

• Create functions/pools/preparePoolCreation.ts callable function
• Verify user authentication via Firebase Auth
• Extract wallet address from auth token
• Check if wallet is already whitelisted via isAuthorizedCreator()
• If not whitelisted: call setCreatorAuthorization(wallet, true)
• Backend pays gas for whitelisting transaction
• Return success response when ready
• Add error handling for failed whitelisting attempts
• Set up backend service wallet with private key
• Fund backend wallet with gas tokens (POL on Polygon Amoy)
• Store private key securely in Firebase Functions config
• Configure ethers.js wallet for contract interactions

Gas Cost Optimization

• ✅ Only pay gas when user actually creates a pool (not on signup)
• ✅ Only whitelist each user once (check before whitelisting)
• ✅ Backend pays ~$0.01-0.05 per whitelisted user
• ✅ More cost-effective than immediate whitelisting on signup

Security Considerations

• Verify Firebase Auth before whitelisting
• Rate limit to prevent abuse
• Securely store backend wallet private key
• Monitor gas usage and wallet balance

Acceptance Criteria

• Function successfully whitelists authenticated users
• Idempotent (doesn't whitelist already-whitelisted users)
• Backend wallet properly funded and configured
• Error handling covers all failure scenarios
• Function integrated with mobile app flow

Depends On

Contract deployment with whitelist mode enabled (#68)

Required By

Mobile pool creation hook (#TBD)

Part of Epic

#35