submit+app: gate Submit on HF OAuth; populate hf_username from profile

submit: default validation + hf_username fields on the pending row