feat(core): sync framework security hardening and accessibility improvements

- add util.Go with panic recovery for background goroutines
- add util.EscapeLike and explicit ESCAPE clause for SQL LIKE queries
- add DummyCheckPassword and subtle.ConstantTimeCompare against timing attacks
- enforce session ID rotation upon login/oauth callback to prevent session fixation
- add sliding window login failure rate limiting and oauth state rate limiting
- fix redis client capture race in pubsub listeners and wait on stop channel
- adjust global --primary to oklch(51.1% 0.262 276.966) for WCAG AA contrast
- fix semantic heading levels and missing aria-labels across UI components
- document security, concurrency, and a11y standards in AGENTS.md

docs/docs.go

@@ -5798,7 +5798,7 @@ const docTemplate = `{
                         }
                     },
                     "400": {
-                        "description": "用户名或密码错误、帐号已禁用等",
+                        "description": "用户名或密码错误",
                         "schema": {
                             "$ref": "#/definitions/response.Any"
                         }

docs/swagger.json

@@ -5791,7 +5791,7 @@
                         }
                     },
                     "400": {
-                        "description": "用户名或密码错误、帐号已禁用等",
+                        "description": "用户名或密码错误",
                         "schema": {
                             "$ref": "#/definitions/response.Any"
                         }

docs/swagger.yaml

@@ -5011,7 +5011,7 @@ paths:
                   $ref: '#/definitions/oauth.BasicUserInfo'
               type: object
         "400":
-          description: 用户名或密码错误、帐号已禁用等
+          description: 用户名或密码错误
           schema:
             $ref: '#/definitions/response.Any'
         "500":