fix: harden SPA navigation with race protection and correctness fixes

- Add navMu to serialize concurrent navigations on the same context
- Replace url.PathEscape with targeted JS string escaper (PathEscape
  mangles full paths and doesn't escape single quotes)
- Collapse syncWithViewTransition into syncView(bool) to remove duplication
- Simplify popstate ready guard in navigate.js
- Preserve URL hash during SPA navigation

h/datastar.go

@@ -14,7 +14,8 @@ func DataIgnoreMorph() H {
 
 // DataViewTransition sets the view-transition-name CSS property on an element
 // via an inline style. Elements with matching names animate between pages
-// during SPA navigation.
+// during SPA navigation. If the element also needs other inline styles,
+// include view-transition-name directly in the Style() call instead.
 func DataViewTransition(name string) H {
 	return Attr("style", "view-transition-name: "+name)
 }