[Bug] Arena Embedded Space Login Failure (401 "User not found")

### Describe the bug
When attempting to log in via the embedded Hugging Face Space (`lmarena-ai/arena-leaderboard`), the UI displays a "Signed in successfully!" notification, but the session is not saved, and the sidebar remains in a logged-out state.

### Technical Diagnostic Logs
- `arena.ai/api/history/unified` returns `401` with `{"message":"User not found"}`.
- Chrome has no `hf_oauth`, `token`, `session`, or Arena auth cookie—only Hugging Face’s non-auth `aws-waf-token`.
- The auth request sent zero cookies; DevTools reported no blocked-cookie reasons.
- No CORS or WebSocket failure was found. The 401 response is same-origin; its CORS header is permissive.
- Console shows an unrelated 500 for `arena.ai/nextjs-api/autoeval/release-banner`, plus report-only CSP warnings for help-page fetches.

### Root Cause Analysis
The Arena login flow reports success client-side, but no persistent Arena session/user record is established. This is not Hugging Face account state syncing: the Space embeds `static.hf.space`, which embeds `arena.ai` as a third-party iframe. The iframe is not credentialless and storage access is available. The backend’s “User not found” response points to failed account provisioning/session issuance in the Arena auth flow.

### Environment / Platform
- Platform: Hugging Face Spaces (`lmarena-ai/arena-leaderboard`)
- Browser: Google Chrome

Start by tracing the Hugging Face Spaces embed authentication flow and the arena.ai/api/history/unified request, then inspect where login success should provision the Arena session and user record. Done means a login from the embedded Space persists a session, the sidebar remains signed in, and the history endpoint no longer returns 401 "User not found".

Written by the indexing model from the issue text.