fix: unblock /auth/providers on cold start + show error UI on login

[figitaki]

Summary

Fixes a prod issue where the Valet login page renders with no sign-in buttons — just two dark gray rectangles where the provider buttons should be. Those rectangles were the loading skeleton; users hit the page before the worker finished booting.

Three layered fixes (one commit each):

1. fix(worker): run plugin sync in background, not blocking requests — syncPluginsOnce was awaited in a app.use('*', …) middleware, doing ~47 serial D1 writes before the route handler ran. On a cold isolate, every public request (including /auth/providers) waited for that. Moved it into c.executionCtx.waitUntil(...) so it runs after the response is sent. The registry sync is already idempotent and best-effort — slightly stale content for the first request is fine.

2. fix(worker): skip plugin sync on public latency-critical paths — even with waitUntil, kicking the sync off on every unauthenticated request still wastes D1 capacity on the cold-start path users see most. Skip entirely for /auth/* and /health*. Authenticated traffic on /api/* still drives it.

3. fix(client): show error + retry on LoginForm when providers fetch fails — when /auth/providers errored out, the loading skeleton would disappear and providers would be undefined, so the card rendered with just a title and zero buttons — visually identical to "no providers configured." Added an explicit error message + Retry button, and bumped that one query's retry count from the default 1 to 3 so transient cold-starts don't trip it.

Root cause writeup

Full RCA (with code references) is in the linked secret gist: https://gist.github.com/figitaki/887c9a34e95a8820ba14280399f2abda

Fixes #1, #2, and #3 from that doc. (#4 — rate-limiting the sync — is left as defense-in-depth follow-up.)

Test plan

• cd packages/worker && pnpm typecheck — clean
• cd packages/client && pnpm typecheck — clean
• Deploy to a preview env and confirm /auth/providers returns within ~100ms on a cold isolate
• Force fetchAuthProviders to fail (e.g. block the request in devtools) and confirm the LoginForm shows the error + Retry button instead of an empty card
• Confirm authenticated /api/* traffic still triggers a plugin sync (check worker logs for [plugin-sync])

[yourbuddyconner]

Clean, well-scoped fix. The waitUntil + singleton-promise interaction is safe, skip prefixes align with unauthenticated route mounts, and the client error UI degrades gracefully.