Root cause: auto-login IIFE checks localStorage for current_user, calls
/api/auth/quick-login async, sets token in .then() callback - but never sets
document.getElementById("app").style.display = "flex".
The old if(token) block that shows .app runs synchronously before the fetch
completes, so .app stays display:none.
Fix: add display:flex inside the IIFE's .then callback after successful
quick-login.
