WIP checkpoint: Address review feedback: Fix: navigating Play -> Back logs the user out (should stay logged in)

scripts/main_menu.gd

@@ -65,6 +65,12 @@ func _ready() -> void:
 	_play_button = $CenterContainer/VBoxContainer/PlayButton
 	_quit_button = $CenterContainer/VBoxContainer/QuitButton
 
+	# Default to Play being gated. When a token exists, the async session
+	# check below may take several frames (a real get_me() round-trip);
+	# keeping the button disabled until validation succeeds prevents a fast
+	# click from navigating to world_list with an expired/invalid token.
+	_play_button.disabled = true
+
 	# Check whether a valid session already exists (e.g. user logged in,
 	# navigated to world_list, then clicked Back). If so, restore the
 	# authenticated UI state instead of forcing the login form again.
@@ -85,7 +91,7 @@ func _ready() -> void:
 ## Restore the UI to the authenticated state (Play enabled, welcome label,
 ## auth buttons hidden).
 func _show_authenticated(username: String) -> void:
-	_auth_panel.visible = false
+	_auth_panel.visible = true
 	_status_label.visible = false
 	_welcome_label.text = "Welcome, %s!" % username
 	_welcome_label.visible = true