fix: align in-memory authentication semantics

client.go

@@ -106,6 +106,9 @@ func NewClientWithAuthData(authData AuthData, options ...ClientOption) (*Client,
 	if err != nil {
 		return nil, err
 	}
+	if !authData.zero() {
+		authData = client.authDataWithIdentity(authData)
+	}
 	client.setAuthData(authData)
 	return client, nil
 }
@@ -131,8 +134,11 @@ func newClient(options ...ClientOption) (*Client, error) {
 	return client, nil
 }
 
-// WithAuthDataChanged configures serialized persistence for in-memory auth updates.
-// The callback runs under login serialization, but never while the auth data lock is held.
+// WithAuthDataChanged configures synchronous persistence for in-memory auth updates.
+// The callback is serialized by the client's login lock and may acquire unrelated
+// application locks, but it must not call Client methods other than AuthData.
+// In particular, calling Login or another method that may refresh authentication
+// will deadlock. Returning an error leaves the client's authentication unchanged.
 func WithAuthDataChanged(callback func(AuthData) error) ClientOption {
 	return func(client *Client) error {
 		if callback == nil {