* configs for firebase hosting

* use the implicit FIREBASE_TOKEN

* don't print every command (lowers the chance of printing secret env vars, and for realz only deploy when merging into master