fix: sync ROUTE_ORDER with nav order, guard against navigation race condition

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

public/router.js

@@ -80,12 +80,13 @@ async function importPage(pagePath) {
 // --------------------------------------------------------
 let currentUser = null;
 let currentPath = null;
+let isNavigating = false;
 
 // --------------------------------------------------------
 // Router
 // --------------------------------------------------------
 
-const ROUTE_ORDER = ['/', '/tasks', '/shopping', '/meals', '/calendar',
+const ROUTE_ORDER = ['/', '/tasks', '/calendar', '/meals', '/shopping',
                      '/notes', '/contacts', '/budget', '/settings'];
 
 function getDirection(fromPath, toPath) {
@@ -103,44 +104,53 @@ function getDirection(fromPath, toPath) {
  * @param {boolean} pushState - false beim initialen Load und popstate
  */
 async function navigate(path, userOrPushState = true, pushState = true) {
-  // Überlastung: navigate(path, user) nach Login vs navigate(path, false) beim Init
+  if (isNavigating) return;
-  if (typeof userOrPushState === 'object' && userOrPushState !== null) {
+  isNavigating = true;
-    currentUser = userOrPushState;
-  } else {
-    pushState = userOrPushState;
-  }
 
-  // Alten Pfad merken, bevor currentPath aktualisiert wird — für Richtungsberechnung
+  try {
-  const previousPath = currentPath;
+    // Überlastung: navigate(path, user) nach Login vs navigate(path, false) beim Init
-  currentPath = path;
+    if (typeof userOrPushState === 'object' && userOrPushState !== null) {
+      currentUser = userOrPushState;
+    } else {
+      pushState = userOrPushState;
+    }
 
-  const route = ROUTES.find((r) => r.path === path) ?? ROUTES.find((r) => r.path === '/');
+    // Alten Pfad merken, bevor currentPath aktualisiert wird — für Richtungsberechnung
+    const previousPath = currentPath;
+    currentPath = path;
 
-  // Auth-Guard
+    const route = ROUTES.find((r) => r.path === path) ?? ROUTES.find((r) => r.path === '/');
-  if (route.requiresAuth && !currentUser) {
+
-    try {
+    // Auth-Guard
-      const result = await auth.me();
+    if (route.requiresAuth && !currentUser) {
-      currentUser = result.user;
+      try {
-    } catch {
+        const result = await auth.me();
-      currentPath = null; // Reset damit navigate('/login') nicht geblockt wird
+        currentUser = result.user;
-      navigate('/login');
+      } catch {
+        currentPath = null; // Reset damit navigate('/login') nicht geblockt wird
+        isNavigating = false;
+        navigate('/login');
+        return;
+      }
+    }
+
+    if (!route.requiresAuth && currentUser && path === '/login') {
+      currentPath = null;
+      isNavigating = false;
+      navigate('/');
       return;
     }
-  }
 
-  if (!route.requiresAuth && currentUser && path === '/login') {
+    if (pushState) {
-    currentPath = null;
+      history.pushState({ path }, '', path);
-    navigate('/');
+    }
-    return;
-  }
 
-  if (pushState) {
+    await renderPage(route, previousPath);
-    history.pushState({ path }, '', path);
+    updateNav(path);
+    updateThemeColorForRoute(route);
+  } finally {
+    isNavigating = false;
   }
-
-  await renderPage(route, previousPath);
-  updateNav(path);
-  updateThemeColorForRoute(route);
 }
 
 /**