Always initialize auth before mounting the app so loading state completes
and onAuthStateChange is registered on every route. Gate header auth UI
on !loading to avoid flicker during email confirm and password reset
flows. Load profile before setting user ref so displayUsername shows the
correct name immediately instead of flashing the email.