wlan0 not brought up at boot, only at desktop login.

[kubicle]

Ah, the user is in the set "Everyone" if that option is checked. I didn't know that. Thanks.
I don't run as another user. Would that include other users allowing "everyone" to use their connection?

I'm not 100% sure I've read you correctly, but if you're asking if...:
1. ...system wide networks (made by any user) are available for other users to connect to, then yes.
2. ...any user can create system wide connections, then no. (By default, NetworkManager's policykit configuration restricts modification of system wide connections to admin users only.)

PS- In the systemd logs I posted above, the NetworkManager isn't set up until I log in.

Well, NetworkManager (the service) clearly starts before you log in, but if you haven't configured a system wide network, it will only connect after you login (because it cannot know which user's network it's supposed to connect to until you have logged in). System networks can be connected to without user login as these are available to all users.

and I don't see any use of nmcli before that.

nmcli is just a CLI tool you can use to interact with NetworkManager daemon (the service), similar to GUI tools like the plasma-nm applet.

All the connecting are handled by the NetworkManager service, which has no need to use the cli tool internally. IOW, NetworkManager the service, once it starts, reads it's configuration and connects automatically if it's able and configured to do so. With the nmcli tool you can just interact with the service, if you wish or need to (just like you can with the GUI tools).

[GreyGeek]

Thanks, Kubicle, that clears up a lot of things.

[Erwin Smout]

I believe if you go into your connection's settings, you can check the option to have that connection available to all users, which make it connect before login. That is how I have always done it.
You also specify static addresses, etc from there.

I tried that and I know it didn't work for me. Might have been an issue of root having no access to KWallet (where I assume the passphrase was/is) or might have been me making some mistake, but it didn't work for me.

[kubicle]

I tried that and I know it didn't work for me. Might have been an issue of root having no access to KWallet (where I assume the passphrase was/is) or might have been me making some mistake, but it didn't work for me.

Did you try setting "save password for all users" in the wifi-protection tab in network settings for the connection? (This will save the passphrase in the network config file under /etc/NetworkManager/system-connections).

[Erwin Smout]

Did you try setting "save password for all users" in the wifi-protection tab in network settings for the connection? (This will save the passphrase in the network config file under /etc/NetworkManager/system-connections).

No, don't remember having seen such an option.

[kubicle]

No, don't remember having seen such an option.

I'm running KDE Neon, so I can't be sure the GUI option is there in Kubuntu 16.04, which has an older version of the Plasma desktop. (I haven't used this option before, so I don't really know how long it has been there...although I did try it and it works and connects automatically before login).

The option should be in a drop down menu right below the network password field. If it isn't, it's also possible to modify the network configuration file (/etc/NetworkManager/system-connections/<network_name>) manually, changing "psk-flags=1" to "psk=<password>" (replacing "<password>" with your actual network password).