fix(auth): resolve post-login navigate race condition and add version display (#68) (#70)

Root cause: when auth.me() failed during initial navigation, the catch block
called navigate('/login') without clearing _pendingLoginRedirect. The outer
finally then fired a second concurrent navigate('/login'), which held
isNavigating=true while running. If the user submitted the login form (or
iCloud Keychain autofilled credentials) before the second navigation
completed, navigate('/', user) was silently blocked by the isNavigating guard —
login appeared to succeed but the app never advanced to the dashboard.

Fix: clear _pendingLoginRedirect in the catch block so the finally handler
does not spawn the duplicate navigation.

Also adds a GET /api/v1/version endpoint (no auth required) and shows the
version on the login page, so users can verify their PWA has received the
latest cached JS.

Resolves #68

Co-authored-by: Ulas Kalayci <ulas.kalayci@googlemail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

public/pages/login.js

@@ -7,6 +7,8 @@
 import { auth } from '/api.js';
 import { t } from '/i18n.js';
 
+const VERSION_URL = '/api/v1/version';
+
 /**
  * Rendert die Login-Seite in den gegebenen Container.
  * @param {HTMLElement} container
@@ -56,12 +58,19 @@ export async function render(container) {
           </button>
         </form>
       </div>
+      <p class="login-version" id="login-version"></p>
     </main>
   `;
 
   const form = container.querySelector('#login-form');
   const errorEl = container.querySelector('#login-error');
   const submitBtn = container.querySelector('#login-btn');
+  const versionEl = container.querySelector('#login-version');
+
+  fetch(VERSION_URL)
+    .then((r) => r.json())
+    .then((d) => { versionEl.textContent = t('login.version', { version: d.version }); })
+    .catch(() => {});
 
   form.addEventListener('submit', async (e) => {
     e.preventDefault();