fix: PDS sync race — auth not ready when ensurePdsIdentity runs
initUsername() calls initAuth() but is fire-and-forget. The PDS sync
chain ran concurrently, calling getSession() before auth restored the
session — silently returning null and skipping all sync.
Fix: make initAuth() idempotent (cached promise) and await it explicitly
in both the landing sync chain and ensurePdsIdentity() itself (for doc
editor pages that never call initAuth at all).