🐛 fix(auth): serverConfig never re-fetched after in-SPA login — auth-gated config keys invisible for the whole first session #4538

What — The server config is fetched once, pre-auth (anonymous), and nothing re-fetches it after a successful in-SPA signin/signup. Config keys the API returns only to authenticated callers (e.g. billing.{enabled, meterMode, equivalences} since Node#3566) are therefore absent from serverConfig for the entire first session.

Why — Everything gated on those keys silently fails exactly when it matters most — a user's first session:

• app.vue's nav compute gauge (v-if="isLoggedIn && meterMode", meterMode reads serverConfig?.billing?.meterMode) never mounts.
• signin()'s own post-login meter refresh (auth.store.js:157) is guarded on the same expression — dead code in a real session, since the anonymous fetch can never contain billing.
• A full page reload "fixes" it (the router guard re-fetches with the cookie), which is why the bug hides. OAuth is unaffected (full-page redirect → fresh fetch with cookie).

The bug is generic: any consumer whose config exposes authenticated-only keys has it.

Scope — src/modules/auth/stores/auth.store.js:

• In signin() and signup() success paths (both flip auth in-SPA without a reload): await this.fetchServerConfig() right after the auth state is set, before the meterMode guard, so the guard evaluates against the authenticated config.
• Failure semantics unchanged (decision 2026-08-04): fetchServerConfig() keeps setting serverConfig = null on failure — accepted; a transient failure right after login degrades the config until the next fetch, no special-casing.
• Tests — the existing billing: nav compute gauge not refreshed on login (only on mount/window.focus) — stale/empty until page refresh #4261 tests pre-set serverConfig = { billing: { meterMode: true } }, a state unreachable pre-auth, which is exactly what masked this bug. Rework: anonymous config without billing → signin → re-fetch resolves with billing.meterMode: true → fetchUsageMeter called; re-fetch fails → no crash, no meter call; signup path equivalent.

Scope: validated 2026-08-04