Enforce per-user ownership on survey media in Storage rules

Media authorization in storage/storage.rules is survey-scoped, while the equivalent Firestore rules are owner-scoped.

Storage rules authorize media at survey level, not owner level:
- Reads leak: allow read: if canViewSurvey() ignores canViewDataCollectedByOthers, and read includes list — any collector can list and download everyone's photos, even when Firestore hides their submissions.
- Writes can't be owner-scoped: #2576 had to fall back to organizer-only for update/delete, so owners can't manage their own media.

Cause: the upload path user-media/surveys/{surveyId}/submissions/{taskId}-{uuid}.jpg carries no user or submission ID, and putFile() sets no metadata. The owner is in Firestore (submission['5']) but only reachable submission → path; rules can't query.

Fix: add {submissionId} to the upload path (ground-android) so rules can do an exact firestore.get() and mirror firestore.rules:206-215. Needs a migration for existing objects.

Start with storage/storage.rules and firestore.rules:206-215 to compare the existing authorization checks, then trace putFile() in ground-android and the user-media upload path. Done means uploads carry a submissionId, Storage rules can verify the Firestore owner for reads and writes, and existing objects have a migration path.

Written by the indexing model from the issue text.