Exercise 2: Client-Side Validation Isn't Security — Possible Solution
====================================================================

WHY THE CLIENT-SIDE CHECK ISN'T A SECURITY BOUNDARY
------------------------------
The `if (!name || !expiryDate) return;` check in AddItemForm only runs inside the app's own JavaScript, in the user's own browser. It only stops an honest user from accidentally submitting an incomplete form through the app's own UI - it does nothing to stop someone from opening the browser console, modifying the running app, or calling the Firestore SDK (or the underlying REST API) directly with whatever data they want, entirely bypassing that check. Anyone with access to the client has access to skip client-side code.

WHAT ACTUALLY IS THE SECURITY BOUNDARY
------------------------------
Chapter 6's Firestore Security Rules - declarative rules enforced by Firebase's own servers for every single read and write, regardless of what client-side code did or didn't check beforehand. Rules can't be bypassed by modifying the client, because they're evaluated entirely outside the client's control.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly explains that client-side validation only protects against accidental honest-user mistakes and can be trivially bypassed by anyone willing to skip the client's own code, and correctly names Security Rules as the actual, unavoidable enforcement layer.