Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/components/Navbar.tsx`:
- Around line 29-33: The handleLogout function awaits logout() without error
handling so a rejection will abort the UI flow; wrap the logout() call in
try/catch (or try/catch/finally) inside handleLogout so failures are caught and
logged, and ensure closeMenu() and navigate("/login", { replace: true }) still
run in the finally path (or after a successful logout) to keep the UI
consistent; reference the handleLogout function and the logout, closeMenu, and
navigate calls when making the change.
- Around line 18-19: The navbar is showing unauthenticated links while auth
state is still loading because only isAuthenticated from authContext is used;
update the Navbar to read the authContext's loading flag (e.g., isLoading)
alongside isAuthenticated and only render Login/Signup when isLoading is false
and isAuthenticated is false, and similarly avoid rendering authenticated-only
links (like the /me link, logout button) while isLoading is true; update all
locations using isAuthenticated (references: authContext, isAuthenticated,
logout, and the Navbar render branches around lines that control Login/Signup vs
/me/logout) to gate rendering on !isLoading before deciding which link set to
show.

---

Outside diff comments:
In `@backend/routes/auth.js`:
- Around line 50-65: The logout route is implemented as a GET which causes a
state-changing action to be CSRF-vulnerable; change the route declaration from
router.get("/logout", ...) to router.post("/logout", ...) (the handler body
using req.logout and req.session.destroy stays the same), and update any client
code/tests that call this endpoint to perform a POST request; optionally ensure
CSRF protection/middleware is applied to the POST route if your app uses CSRF
tokens.