perf(subscriptions): cut redundant cold-login list fetches

Two redundancies were inflating the login REQ burst (kind 30000=19 storm in
the real-env console — the cause of the slow hashtags, KNOWN_BUGS #0),
isolated with the channel-sim harness's REQ-signature + timing capture:

1. Duplicate trigger: ProfileModalController.handleAuthLogin called
   subscriptions.loadSubscriptions() AND userBlocks.loadBlocks() DIRECTLY at
   login, on top of the auth coordinator's gated list loads — a second,
   ungated relay round-trip for each. Route them through ensureLoaded()
   instead so they coalesce with the coordinator's in-flight load. Harness:
   subscriptions updateFromRelays now fires ONCE at login instead of 3×
   (≈3× fewer kind-30000 fetches in prod, where each is multiplied by the
   relay set).

2. Fetch/decrypt coupling: a decrypt retry re-ran the full relay fetch even
   though only signer availability had changed. Cache the fetched ciphertext
   (_pendingDecryptEvent) and have scheduleDecryptRetry re-decrypt it via a
   cachedDecryptEvent fast-path in updateFromRelays — no redundant relay
   query per retry.

Validated: MODE=overload (channel drops) still decrypts blocks +
subscriptions + hashtags (DMs OK); full unit suite green; subscription loop
+ aggregation tests still pass.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

js/ui/profileModalController.js

@@ -5157,12 +5157,22 @@ export class ProfileModalController {
 
     this.renderSavedProfiles();
 
-    // Trigger aggressive parallel fetches
+    // Warm blocks + subscriptions, but go through ensureLoaded() (not the raw
+    // loadBlocks/loadSubscriptions) so these COALESCE with the auth coordinator's
+    // login-time list loads instead of issuing a second, ungated fetch. The
+    // direct calls here each kicked off an independent relay round-trip,
+    // doubling the cold-login kind-30000/10000 REQ burst (KNOWN_BUGS #0).
     if (activePubkey) {
-      if (this.services.userBlocks) {
+      if (this.services.userBlocks?.ensureLoaded) {
+        this.services.userBlocks.ensureLoaded(activePubkey).catch(noop);
+      } else if (this.services.userBlocks?.loadBlocks) {
         this.services.userBlocks.loadBlocks(activePubkey).catch(noop);
       }
-      if (this.subscriptionsService) {
+      if (this.subscriptionsService?.ensureLoaded) {
+        this.subscriptionsService
+          .ensureLoaded(activePubkey, { allowPermissionPrompt: false })
+          .catch(noop);
+      } else if (this.subscriptionsService?.loadSubscriptions) {
         this.subscriptionsService
           .loadSubscriptions(activePubkey, { allowPermissionPrompt: false })
           .catch(noop);