GeezerVison

Fixes #3488
Fixes #3128
Refs #3089

Following docs/app-check.md in a server-rendered app fails the build with ReferenceError: document is not defined. provideAppCheck runs the app's setup function during server rendering, and the reCAPTCHA providers need a browser. This PR skips App Check during server rendering by default, with an opt-in for apps that run it there on purpose.

Breaking change

• During server rendering, AngularFire no longer calls the function passed to provideAppCheck, and inject(AppCheck) returns null there. The browser is unchanged.
• Apps that run App Check on the server on purpose, with a server-capable provider such as a CustomProvider backed by the Admin SDK, keep the old behavior with one line in their server config:

{ provide: APP_CHECK_ON_SERVER, useValue: true }

• Firebase's documented route for App Check in server renders passes a client-generated token to initializeServerApp as appCheckToken. It needs no App Check instance on the server, so this change does not affect it.

Changes

• appCheckInstanceFactory returns early during server rendering unless APP_CHECK_ON_SERVER is true, and in development mode it warns once that it skipped App Check.
• APP_CHECK_ON_SERVER is a new export from @angular/fire/app-check, false by default.
• defaultAppCheckInstanceFactory drops skipped entries before choosing the default instance. ɵgetDefaultInstanceOf reads .app on every entry, so an app calling provideAppCheck twice would otherwise crash on the server.
• New specs in src/app-check/app-check.spec.ts cover the server default, two provideAppCheck calls on the server, the opt-in, and the browser.
• The docs change follows in a separate PR.

Verification

On an Angular 21.2 app rendered at build time, using the setup from docs/app-check.md:

• 21.0.0-rc.1: ng build fails with ReferenceError: document is not defined.
• This branch: the build succeeds, and AppCheck is null on the server.
• This branch with APP_CHECK_ON_SERVER and the reCAPTCHA provider: the original error returns, so the opt-in does run App Check on the server.
• This branch with APP_CHECK_ON_SERVER and a CustomProvider on the server: the build succeeds with a real AppCheck on the server.
• The warning prints in a development build and not in a production build.
• npm run test:chrome-headless: 111 passed, 48 skipped. npm run test:node: 331 specs, 0 failures.
• Each new spec fails when the code it covers is disabled: the server skip, the filter, or the opt-in.