If the functioning of your app is dependent on this User being successfully decoded, and there is truly nothing to do without it, I would have the user field in my model be a User and not a Maybe User, decode the user in my init function, and Debug.crash if a user could not be decoded.
If you would like a more friendly error message and to eliminate all calls to Debug.crash, which are worthy goals, you could make your App.Model an ADT of something like:
Model
= Invalid String
| Valid ModelProps
Then in init if your user didn’t decode you’d set model equal to Invalid "Must have a valid user" or something and case off of your model type in update and view
Edit:
Here’s a link to an example that avoids Debug.crash in Ellie https://ellie-app.com/BCthmbKya1/0
if you change "a" on line 30 to a string of an int like "0", you can see how it works on successful decoding.