Avoid protected startup requests before sign-in

[bt1142msstate]

Summary

• defer field metadata loading until a verified session exists
• skip the initial template request while signed out
• keep the sign-in startup state clear and quiet
• add browser coverage proving no protected startup requests occur before authentication

Validation

• npm run lint
• npm run test:browser (passes)
• cache manifest current
• full static matrix: 11 architecture checks passed; the two known Git-history checks were interrupted after hanging on the local Documents filesystem and will run in clean CI