feat(core): sync framework security hardening and accessibility improvements

- add util.Go with panic recovery for background goroutines
- add util.EscapeLike and explicit ESCAPE clause for SQL LIKE queries
- add DummyCheckPassword and subtle.ConstantTimeCompare against timing attacks
- enforce session ID rotation upon login/oauth callback to prevent session fixation
- add sliding window login failure rate limiting and oauth state rate limiting
- fix redis client capture race in pubsub listeners and wait on stop channel
- adjust global --primary to oklch(51.1% 0.262 276.966) for WCAG AA contrast
- fix semantic heading levels and missing aria-labels across UI components
- document security, concurrency, and a11y standards in AGENTS.md

frontend/app/(main)/admin/database/components/cache-manager.tsx

@@ -189,9 +189,9 @@ export function CacheManager({ refreshTrigger }: CacheManagerProps) {
           <div className='grid grid-cols-1 lg:grid-cols-5 gap-6'>
             {/* 左边：状态区 (2/5 cols) */}
             <div className='lg:col-span-2 space-y-4'>
-              <h4 className='text-xs font-semibold text-muted-foreground uppercase tracking-wider'>
+              <p className='text-xs font-semibold text-muted-foreground uppercase tracking-wider'>
                 {t('runtimeStatus')}
-              </h4>
+              </p>
               <div className='grid grid-cols-1 sm:grid-cols-2 gap-4'>
                 {/* 已占空间 */}
                 <div className='p-4 rounded-xl border border-border/40 bg-background/30 backdrop-blur-xs hover:border-primary/20 transition-all duration-300'>
@@ -240,9 +240,9 @@ export function CacheManager({ refreshTrigger }: CacheManagerProps) {
 
             {/* 右边：配置区 (3/5 cols) */}
             <div className='lg:col-span-3 border-t lg:border-t-0 lg:border-l border-border/40 pt-6 lg:pt-0 lg:pl-6 space-y-4'>
-              <h4 className='text-xs font-semibold text-muted-foreground uppercase tracking-wider'>
+              <p className='text-xs font-semibold text-muted-foreground uppercase tracking-wider'>
                 {t('policyConfig')}
-              </h4>
+              </p>
               <form onSubmit={handleSaveConfig} className='space-y-4'>
                 <div className='grid grid-cols-1 sm:grid-cols-2 gap-4'>
                   <div className='space-y-1.5'>

frontend/app/(main)/admin/database/components/sql-console.tsx

@@ -165,7 +165,10 @@ export function SQLConsole({ dbType, onClose }: SQLConsoleProps) {
                 {t('quickTemplates')}
               </span>
               <Select onValueChange={handlePresetSQLChange}>
-                <SelectTrigger className='h-7 w-[180px] text-[11px] bg-background'>
+                <SelectTrigger
+                  aria-label={t('selectPresetSQL')}
+                  className='h-7 w-[180px] text-[11px] bg-background'
+                >
                   <SelectValue placeholder={t('selectPresetSQL')} />
                 </SelectTrigger>
                 <SelectContent>

frontend/app/(main)/admin/database/components/table-browser.tsx

@@ -140,7 +140,10 @@ export function TableBrowser({
             <Skeleton className='h-8 w-48' />
           ) : (
             <Select value={selectedTable} onValueChange={handleTableChange}>
-              <SelectTrigger className='h-8 w-[200px] text-xs bg-background border-border/40'>
+              <SelectTrigger
+                aria-label={t('selectTable')}
+                className='h-8 w-[200px] text-xs bg-background border-border/40'
+              >
                 <SelectValue placeholder={t('selectTable')} />
               </SelectTrigger>
               <SelectContent className='max-h-[300px]'>