perf(startup): defer Firebase SDK init to unblock first paint

[roiguri]

Source: Deep code review — docs/code-review-2026-05.md (finding P1, P2).

Where: src/app.js:15-16

Issue: ~88KB modular Firebase is loaded synchronously at startup, blocking first paint and hurting the unauthenticated home-page LCP.

Fix: Defer initFirebase() until the first auth/data call — wrap as a lazy singleton in firebase-config.js. The header avatar already needs auth, so it can trigger init.

Verification: Lighthouse home-page LCP before/after.