🐛 Issue: Timing attack vector — Map briefly visible after returning from background

When the app is minimized (Home) and then reopened while in **MapActivity**, the map becomes visible for about 2 seconds before the login or biometric screen appears. This creates a potential timing attack vector where sensitive map data is briefly exposed.

---

#### **Steps to Reproduce**
1. Open the app and navigate to **MapActivity** (user logged in).
2. Press the **Home** button to send the app to the background.
3. Reopen the app quickly from recents or launcher.
4. Observe: The map appears for ~2 seconds before the login screen is shown.

---

#### **Observed Behavior**
- Map content (tiles, markers, user path, etc.) is visible for a short time.
- Then, the authentication overlay appears.

#### **Expected Behavior**
- No map or sensitive data should be visible before authentication is fully verified.

---

#### **Security Impact**
- Short visual exposure of sensitive map/location data.
- Can be used for simple timing or observation-based attacks.
- Violates privacy and data protection expectations.

---

#### **Suspected Cause**
- `MapActivity` resumes and renders immediately in `onResume()` or `onStart()` before the authentication check completes.
- Authentication screen is launched asynchronously, causing a visible delay.

---

#### **Proposed Fix**
1. Block or hide map rendering until authentication is confirmed.
2. In `onResume()`, perform synchronous session/auth checks before showing the map.
3. Show a neutral placeholder (black or blurred view) until auth success.
4. Delay map initialization or set `mapView.visibility = GONE` until verification passes.
5. Ensure no sensitive overlays (routes, tracks) render before login.
6. Add timestamps/logging to track race conditions between auth and UI resume.

Start in MapActivity and trace onResume() and onStart() alongside the asynchronous login or biometric launch. Check when mapView and sensitive overlays become visible, then verify the app shows only a neutral placeholder until authentication succeeds; reproduce the background-and-reopen steps to confirm no map content appears beforehand.

Written by the indexing model from the issue text.