feat(api): complete unified v2 mobile surface

backend/unified-api/scripts/ensure-v2-demo-users.mjs

@@ -0,0 +1,64 @@
+import { signInWithPassword, signUpWithPassword } from '../src/services/identity-toolkit.js';
+
+const ownerEmail = process.env.V2_DEMO_OWNER_EMAIL || 'legendary.owner+v2@krowd.com';
+const staffEmail = process.env.V2_DEMO_STAFF_EMAIL || 'ana.barista+v2@krowd.com';
+const ownerPassword = process.env.V2_DEMO_OWNER_PASSWORD || 'Demo2026!';
+const staffPassword = process.env.V2_DEMO_STAFF_PASSWORD || 'Demo2026!';
+
+async function ensureUser({ email, password, displayName }) {
+  try {
+    const signedIn = await signInWithPassword({ email, password });
+    return {
+      uid: signedIn.localId,
+      email,
+      password,
+      created: false,
+      displayName,
+    };
+  } catch (error) {
+    const message = error?.message || '';
+    if (!message.includes('INVALID_LOGIN_CREDENTIALS') && !message.includes('EMAIL_NOT_FOUND')) {
+      throw error;
+    }
+  }
+
+  try {
+    const signedUp = await signUpWithPassword({ email, password });
+    return {
+      uid: signedUp.localId,
+      email,
+      password,
+      created: true,
+      displayName,
+    };
+  } catch (error) {
+    const message = error?.message || '';
+    if (message.includes('EMAIL_EXISTS')) {
+      throw new Error(`Firebase user ${email} exists but password does not match expected demo password.`);
+    }
+    throw error;
+  }
+}
+
+async function main() {
+  const owner = await ensureUser({
+    email: ownerEmail,
+    password: ownerPassword,
+    displayName: 'Legendary Demo Owner V2',
+  });
+
+  const staff = await ensureUser({
+    email: staffEmail,
+    password: staffPassword,
+    displayName: 'Ana Barista V2',
+  });
+
+  // eslint-disable-next-line no-console
+  console.log(JSON.stringify({ owner, staff }, null, 2));
+}
+
+main().catch((error) => {
+  // eslint-disable-next-line no-console
+  console.error(error);
+  process.exit(1);
+});