fix: prevent cross-user data exposure in IndexedDB operations (closes #885)

[namann5]

Description

Fixes a critical privacy vulnerability where \updateLocalWorkoutsFromFirestore\ loads all local IndexedDB records across all users via \store.getAll(), exposing cross-user workout data in memory on shared devices. Also fixes an authorization gap in \deleteWorkout()\ where the \userId\ parameter was accepted but never validated.

Changes

\src/services/workoutSyncService.ts\

1. **\updateLocalWorkoutsFromFirestore**: Replaced \store.getAll()\ (loads every record across all users) with \store.index('userId').getAll(IDBKeyRange.only(userId))\ — only the current user's local records are loaded into memory.

2. **\deleteWorkout**: Added an ownership check — before deleting, fetches the record and verifies
   ecord.userId === userId. If the IDs don't match, the deletion is rejected.

Impact

• Before: User A's sync from Firestore loads User B's private workout data (exercise type, reps, scores, timestamps) into memory on shared devices
• Before: \deleteWorkout(userId, id)\ would delete any record by primary key, ignoring the userId parameter entirely
• After: Only the authenticated user's data is loaded during sync; local deletions verify ownership

Related

Closes #885

[vercel]

@namann5 is attempting to deploy a commit to the somiljain2024-4175's projects Team on Vercel.

A member of the Team first needs to authorize it.

[diksha78dev]

@namann5 Make ci pipeline checks green.