Reply to Activity sign-in before copying starter references; log auth timings

[CompleteDotTech]

Problem

Activity sign-in in a new server (Rogue's Community Server) fails with:

Authorization code exchange (HTTP 502: The server returned an unreadable response; reference a4d20f808c1acd27-CLE)

The 502 has a non-JSON body and a Cloudflare ray as its reference, so it came from a proxy, not from TypeCheck (every TypeCheck error is JSON). Invalid exchanges through the same Discord proxy and directly against GoDaddy return JSON 401 in 0.16–0.4 s, and the PUBLISH process has not restarted since the 19:03 deploy. Only a real exchange fails, and for a server's first sign-in that request also copied 33 starter reference images (checksum, normalize, store, one transaction) before replying. The server logged nothing per request, so the slow step could not be confirmed from logs.

Change

• Copy starter references after creating the session, at most once per server at a time, logging starter_references_seed with outcome and duration. A failed copy no longer fails sign-in.
• Log every /api/auth/* request and every 5xx (http_request / http_error: status, duration, request ID), plus per-stage timings for the Activity exchange (auth_stages: discord_oauth, settings, authority, session). No tokens, bodies or member data.
• New test: sign-in succeeds when the starter copy cannot run (it failed with 500 before this change).

Validation

• npm run check clean; npm test 380/380 pass; the new test fails on the previous code.
• SHA256SUMS refreshed and verified.

If sign-in still fails after this deploys, the auth_stages and http_request lines will show which stage is slow.

🤖 Generated with Claude Code