Firebase BoM in android/app/build.gradle is inert — plugins' newer BoM wins

[BurningAXE]

android/app/build.gradle declares a Firebase BoM that does not actually govern any version, so the block reads as a pin while the real versions come from elsewhere.

What's declared

// The background receiver writes userLocations/{uid} in Kotlin so a
// location update never depends on a Dart engine being alive. Declared
// explicitly via the BoM rather than relying on the versions the Flutter
// plugin AARs happen to pull in transitively.
implementation platform("com.google.firebase:firebase-bom:33.7.0")
implementation "com.google.firebase:firebase-firestore"
implementation "com.google.firebase:firebase-auth"
implementation "com.google.firebase:firebase-crashlytics"

What actually resolves

From release-artifact-dependencies.xml:

Artifact	Resolved	BoM 33.7.0 would give
firebase-firestore	26.1.0	25.x
firebase-auth	24.0.1	23.x
firebase-crashlytics	20.0.4	19.x

The Flutter plugins (firebase_core 4.6.0, firebase_crashlytics 5.2.6, …) each declare their own
platform("com.google.firebase:firebase-bom:${FirebaseSDKVersion}"), which is newer than 33.7.0.
Gradle resolves to the highest, so the plugins' BoM wins and the app module's is inert.

Why it matters

The comment says the point is to avoid "relying on the versions the Flutter plugin AARs happen to
pull in transitively" — but that is exactly what is happening. The declaration creates a false sense
that native Firebase versions are pinned here. Anyone debugging a native Firebase version problem
would read 33.7.0 and be looking at the wrong number.

It is not currently causing a defect: the resolved versions are self-consistent (they all come from
one newer BoM), and the app builds and runs. This is a correctness-of-intent cleanup, not a bug.

Options

1. Drop the app-module BoM and let firebase_core's FirebaseSDKVersion govern, keeping the
   unversioned implementation lines. Simplest, and makes the single source of truth explicit.
2. Raise FirebaseSDKVersion via ext in android/build.gradle — that property is respected
   by every plugin (getRootProjectExtOrDefaultProperty), so it is the real lever if the goal is to
   control native Firebase versions from this repo.
3. Bump 33.7.0 to whatever the plugins currently resolve to. Keeps the declaration meaningful but
   needs re-checking on every flutter pub upgrade.

Option 2 is the one that actually delivers what the existing comment intends.

Either way, update the comment so it describes what the code does.

Context

Found while adding firebase-crashlytics to that same block, so the native background path could
report non-fatals (the arrival catch-up previously died silently in a process where Dart's error
handlers cannot reach).