fix(hub): install the token header hijack at startup

Implicit tokens are disabled process-wide, so the hijack that re-attaches the
token explicitly is what keeps gated repos reachable. It was installed by the
checkpoint loader and the caption paths, so loading a video model into a fresh
session sent unauthenticated requests and gated repos answered 401.

modules/models_hf.py

@@ -1,6 +1,7 @@
 import os
 import time
 import gradio as gr
+from modules import sd_hijack_hfhub
 from modules.logger import log
 from modules.shared import opts
 
@@ -37,6 +38,10 @@ def hf_init():
         obfuscated_token = 'hf_...' + opts.huggingface_token[-4:]
     log.info(f'Huggingface: transfer={opts.hf_transfer_mode} parallel={opts.sd_parallel_load} direct={opts.diffusers_to_gpu} token="{obfuscated_token}" cache="{opts.hfcache_dir}"')
 
+    # the disable flag above drops the token from token=None requests, which is what diffusers and
+    # transformers send; the hijack re-adds it explicitly and has to precede the first download
+    sd_hijack_hfhub.init_hijack()
+
 
 def hf_check_cache():
     t0 = time.time()