fix(auth): stop beforeAuthStateChanged from holding the app unstable

[armando-navarro]

Fixes #3748

Restores beforeAuthStateChanged: { blockUntilFirst: false }, which #3590 added and #3613 dropped without comment.

Changes

• @angular/fire/auth wraps beforeAuthStateChanged with blockUntilFirst set to true, so registering the hook adds a pending task that clears only when the callback first runs. Firebase runs this callback only on a sign-in or sign-out, so for a visitor who does neither, the app never becomes stable.
  • In the browser, ApplicationRef.whenStable() never resolves.
  • When the hook is also registered on the server, ng build fails during route extraction, and a server that renders per request never responds.
• With the override, the callback still runs inside Angular's zone and injection context, and its returned promise still reaches Firebase, so a rejection still cancels the sign-in.
  • One other difference: a call outside an injection context now logs its per-call warning only at the verbose log level, as onMessage does.
• Adding more injector safety #3590 added the override with the note "beforeAuthStateChanged should not block". zone log verbosity #3613 removed it at the spot where it added log-level overrides, and none of the issues zone log verbosity #3613 fixed involve this function, so the removal looks accidental.
• docs/auth.md and the sample keep importing beforeAuthStateChanged from firebase/auth until a release carries this fix.

Verification

On an Angular 21.2 server-rendered app, comparing 21.0.0-rc.1 with a build of this branch:

• Hook registered on the server: ng build on rc.1 fails after 34 seconds with Routes extraction was aborted. TimeoutError. With this branch it succeeds.
• Hook registered on the server only while answering a request, with every route rendered per request: each request to rc.1 got no response within 60 seconds. With this branch, each returned a server-rendered page in under 30 milliseconds.
• The cookie sync from docs/auth.md, which registers the hook only in the browser: on rc.1 the app did not become stable within 10 seconds. With this branch it became stable after 25 milliseconds.
• npm run test:node: 331 specs, 0 failures. npm run test:chrome-headless: 107 passed, 48 skipped.

[tyler-reitz]

Approving.

Rebuilt from the generator and confirmed src/auth/firebase.ts matches its output, with a control run flipping the override to prove that check can fail. The #3590 / #3613 history is exactly as you describe.

Two follow-ups, neither blocking:

The beforeAuthStateChanged from firebase/auth section of docs/auth.md describes the blocking behavior in the present tense and points at #3748 as open. Merging this closes #3748, so that section wants a version qualifier like the one in #3769's docs, or a follow-up issue to point at.

This override has now been added, dropped and re-added with no test. A spec in src/auth/auth.spec.ts asserting the app becomes stable after registering the hook would have gone red on #3613.

[armando-navarro]

Thanks Tyler.

• docs/auth.md: done in the latest commit.
  • The section now says the blocking behavior applies to AngularFire 21.0.0-rc.1 and earlier, with beforeAuthStateChanged imported from @angular/fire/auth makes ng build fail during route extraction #3748 as the reference.
  • The code sample keeps its firebase/auth import, since that works on every release, and moving it to @angular/fire/auth waits for a release that carries this fix.
  • I also dropped the line saying the @angular/fire/auth import makes ng build hang. The guide's code registers the hook only in the browser, so its own build succeeds, and the build failure needs the hook registered on the server as well.