fix(firebase): keep deployment token out of argv

[WNZhao]

Summary

• authenticate Firebase CLI through its supported FIREBASE_TOKEN environment variable
• stop putting the long-lived deployment token in process arguments
• add a regression test asserting the secret is absent from argv

Firebase documents both authentication paths and warns that these tokens are extremely sensitive long-lived credentials. Keeping the token out of argv avoids exposure through process inspection and captured command errors.

Verification

• pnpm exec vitest run packages/targets/deploy-firebase/src/index.test.ts (8/8)
• pnpm --filter @profullstack/sh1pt-target-deploy-firebase typecheck
• git diff --check