feat(core): sync framework security hardening and accessibility improvements

- add util.Go with panic recovery for background goroutines
- add util.EscapeLike and explicit ESCAPE clause for SQL LIKE queries
- add DummyCheckPassword and subtle.ConstantTimeCompare against timing attacks
- enforce session ID rotation upon login/oauth callback to prevent session fixation
- add sliding window login failure rate limiting and oauth state rate limiting
- fix redis client capture race in pubsub listeners and wait on stop channel
- adjust global --primary to oklch(51.1% 0.262 276.966) for WCAG AA contrast
- fix semantic heading levels and missing aria-labels across UI components
- document security, concurrency, and a11y standards in AGENTS.md

frontend/app/(main)/admin/push/components/events-tab.tsx

@@ -435,6 +435,7 @@ export function EventsTab() {
                       onCheckedChange={() =>
                         toggleEventMutation.mutate(event.id)
                       }
+                      aria-label={t('colStatus')}
                       className='scale-75'
                     />
                   </TableCell>
@@ -449,6 +450,7 @@ export function EventsTab() {
                             <Button
                               variant='ghost'
                               size='icon'
+                              aria-label={t('configure')}
                               className='h-6 w-6 text-muted-foreground hover:text-foreground'
                               onClick={() => handleEditEventClick(event)}
                             >
@@ -467,6 +469,7 @@ export function EventsTab() {
                             <Button
                               variant='ghost'
                               size='icon'
+                              aria-label={t('delete')}
                               className='h-6 w-6 text-muted-foreground hover:text-destructive hover:bg-destructive/10'
                               disabled={deleteEventMutation.isPending}
                               onClick={() => setDeleteTarget(event)}