Do my friends need an account?
Only the organizer does. Everyone else joins with the trip code and their name through anonymous sign-in, taps into plans straight away, and can attach an email later to keep their trips across phones.
What stops two people from leading the same plan?
Take the lead runs as a Firestore transaction that only writes when the plan has nobody leading it yet, and the security rules that ship with the app enforce the same thing on the server. The rules chapter in the documentation lists, field by field, what a phone may write and what only the panel may change.
What does the Laravel panel add?
A Filament panel that opens the same Firebase project in a browser: trips, plans, members and packing lists to read and edit, the sign-in users, a push notification page, nightly Firestore snapshots and the day-before trip reminders a phone cannot send itself. The app keeps talking to Firebase directly.