Sign in before uploading proof.

Browser uploads and watcher keys are both tied to a signed-in identity now. That keeps replay evidence attached to a real account instead of anonymous guest rows.