perf: cut ~800ms off dashboard first paint

Three changes that target the auth waterfall before bootstrap fires:

1. auth-provider: drop the unconditional currentUser.reload() and
   stop forcing getIdToken(true) on every onAuthStateChanged. Both
   were extra round-trips to Firebase on every page load. The cached
   token is still server-verifiable and emailVerified is persisted
   in the SDK's local store. The "I changed something, pick it up"
   path (refreshUser) still passes forceRefresh: true so the email-
   verification flow keeps working.

2. auth-provider: expose firebaseUser on the context immediately
   when onAuthStateChanged fires — before /api/user/profile is
   even called. Consumers can now key off that to start their own
   authenticated fetches in parallel with profile.

3. dashboard-container: key the bootstrap effect on firebaseUser?.uid
   instead of user?.uid. Bootstrap now fires the moment Firebase
   confirms a session, in parallel with the auth-provider's profile
   fetch. The dashboard's render gate still waits on both (user +
   isLoading), so wall-clock load = max(profile, bootstrap) instead
   of profile + bootstrap. Drops the redirect-to-login gate to only
   fire after authLoading actually completes, so the parallel kick-
   off doesn't accidentally bounce the user mid-init.

Combined savings on dashboard cold load: ~600-1000ms depending on
Firebase / network. No change to security posture — every API call
still verifies the ID token server-side.

Author: WasThatRudy

components/providers/auth-provider.tsx

@@ -33,6 +33,10 @@ interface UserProfile {
 
 interface AuthContextType {
     user: UserProfile | null;
+    // The raw Firebase user, exposed so consumers (like the dashboard) can
+    // start their own authenticated fetches as soon as Firebase confirms the
+    // session — without waiting for /api/user/profile to also come back.
+    firebaseUser: FirebaseUser | null;
     loading: boolean;
     login: (email: string, password: string) => Promise<void>;
     register: (formData: FormData) => Promise<void>;
@@ -45,6 +49,7 @@ interface AuthContextType {
 
 const AuthContext = createContext<AuthContextType>({
     user: null,
+    firebaseUser: null,
     loading: true,
     login: async () => { },
     register: async () => { },
@@ -59,15 +64,28 @@ import { useToast } from "@/hooks/use-toast";
 
 export function AuthProvider({ children }: { children: React.ReactNode }) {
     const [user, setUser] = useState<UserProfile | null>(null);
+    const [firebaseUser, setFirebaseUser] = useState<FirebaseUser | null>(null);
     const [loading, setLoading] = useState(true);
     const router = useRouter();
     const { toast } = useToast();
 
-    const fetchUserProfile = async (currentUser: FirebaseUser) => {
+    // forceRefresh: when true, force-reloads the Firebase user (network call)
+    //   and force-refreshes the ID token (another network call). Use this only
+    //   when something has actually changed server-side that we need to pick
+    //   up — e.g. after email verification (emailVerified flag flipped) or an
+    //   explicit "refresh" action.
+    // Default false: skip both extra round-trips. The cached token is still
+    //   valid (Firebase auto-refreshes ~5min before expiry) and emailVerified
+    //   is persisted in the SDK's local store. Saves ~600-800ms per call.
+    const fetchUserProfile = async (
+        currentUser: FirebaseUser,
+        forceRefresh: boolean = false,
+    ) => {
         try {
-            // Force reload user to get latest emailVerified status
-            await currentUser.reload();
-            const token = await currentUser.getIdToken(true);
+            if (forceRefresh) {
+                await currentUser.reload();
+            }
+            const token = await currentUser.getIdToken(forceRefresh);
             const response = await fetch(API_ENDPOINTS.userProfile, {
                 headers: {
                     Authorization: `Bearer ${token}`,
@@ -112,9 +130,13 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
     };
 
     useEffect(() => {
-        const unsubscribe = onAuthStateChanged(auth, async (firebaseUser) => {
-            if (firebaseUser) {
-                await fetchUserProfile(firebaseUser);
+        const unsubscribe = onAuthStateChanged(auth, async (fbUser) => {
+            // Publish the Firebase user IMMEDIATELY (before profile fetch) so
+            // consumers can fire their own authenticated calls in parallel
+            // with /api/user/profile instead of waiting in series.
+            setFirebaseUser(fbUser);
+            if (fbUser) {
+                await fetchUserProfile(fbUser);
             } else {
                 setUser(null);
             }
@@ -248,10 +270,11 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
 
     const refreshUser = useCallback(async () => {
         if (auth.currentUser) {
-            // Force token refresh to update emailVerified claim in the token if needed
-            await auth.currentUser.reload();
             setLoading(true);
-            await fetchUserProfile(auth.currentUser);
+            // Force reload + token refresh — this is the explicit "I changed
+            // something server-side, pick it up" path (e.g. after email
+            // verification). fetchUserProfile handles both internally.
+            await fetchUserProfile(auth.currentUser, true);
             setLoading(false);
         }
     }, []);
@@ -292,6 +315,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
 
     const contextValue = useMemo(() => ({
         user,
+        firebaseUser,
         loading,
         login,
         register,
@@ -300,7 +324,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
         getToken,
         sendVerificationEmail,
         resetPassword
-    }), [user, loading, login, register, logout, refreshUser, getToken, sendVerificationEmail, resetPassword]);
+    }), [user, firebaseUser, loading, login, register, logout, refreshUser, getToken, sendVerificationEmail, resetPassword]);
 
     return (
         <AuthContext.Provider value={contextValue}>

components/registration/dashboard-container.tsx

@@ -253,7 +253,7 @@ function StatusStrip({
 }
 
 export function DashboardContainer() {
-  const { user, isAuthenticated, isLoading: authLoading, getToken } = useAuth();
+  const { user, firebaseUser, isLoading: authLoading, getToken } = useAuth();
   const router = useRouter();
   const { toast } = useToast();
   const [team, setTeam] = useState<Team | null>(null);
@@ -351,11 +351,15 @@ export function DashboardContainer() {
   }, [user]);
 
   useEffect(() => {
-    // Wait for the auth provider to finish initialising before deciding
-    // whether to redirect or kick off the data fetch.
-    if (authLoading) return;
-    if (!isAuthenticated || !user) {
-      router.push("/login");
+    // We kick off /api/me/bootstrap the moment Firebase confirms a session,
+    // in parallel with the auth-provider's /api/user/profile fetch — they're
+    // independent, and waiting for profile to finish before starting bootstrap
+    // adds an unnecessary serial RTT to the dashboard's first paint.
+    if (!firebaseUser) {
+      // No Firebase session. Only redirect once the auth-provider has actually
+      // finished initialising — before that, firebaseUser==null just means
+      // "we haven't heard back from onAuthStateChanged yet".
+      if (!authLoading) router.push("/login");
       return;
     }
 
@@ -447,13 +451,13 @@ export function DashboardContainer() {
     };
 
     fetchData();
-    // Depend on user?.uid (stable string) rather than user (object reference
-    // that the auth-provider recreates on every emailVerified refresh / Strict
-    // Mode double-mount). Without this, bootstrap re-fires whenever the user
-    // object identity changes — even though the actual uid hasn't — and the
-    // dashboard flashes back into its skeleton state.
+    // Key on firebaseUser?.uid (stable string available as soon as Firebase
+    // confirms the session) rather than user?.uid (set later, after profile
+    // fetch). This lets bootstrap run in parallel with /api/user/profile
+    // instead of in series. Strict Mode / token rotations don't change uid,
+    // so the effect doesn't re-fire and flash the skeleton.
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [user?.uid, isAuthenticated, authLoading, router, refreshTrigger]);
+  }, [firebaseUser?.uid, authLoading, router, refreshTrigger]);
 
   const getTeamStatus = ():
     | "none"