Registration avatar upload raced with AuthRedirect — setting the Zustand token triggered navigation before the upload could finish. Now the token is stored in localStorage (for API auth) but not in Zustand until the avatar upload completes, so the page stays mounted throughout. Extracts initSession() from login/register for reuse.