v0.1.12: Ensure auth before embedding userId in requests (#30, #31) (#33)

add_serving() read self._user_id while building its payload, but on a
cold client _ensure_auth() hadn't run yet, so it froze userId=null and
Cronometer rejected the write. The retry re-sent the same dict and
failed identically, burning a second login (#31).

Add a user_id property that logs in before returning the id, and read
identity through it in add_serving and the v3 URL. Payloads are now
built from authenticated state, so the retry only ever recovers a
genuine token expiry.