feat(core): sync framework security hardening and accessibility improvements

- add util.Go with panic recovery for background goroutines
- add util.EscapeLike and explicit ESCAPE clause for SQL LIKE queries
- add DummyCheckPassword and subtle.ConstantTimeCompare against timing attacks
- enforce session ID rotation upon login/oauth callback to prevent session fixation
- add sliding window login failure rate limiting and oauth state rate limiting
- fix redis client capture race in pubsub listeners and wait on stop channel
- adjust global --primary to oklch(51.1% 0.262 276.966) for WCAG AA contrast
- fix semantic heading levels and missing aria-labels across UI components
- document security, concurrency, and a11y standards in AGENTS.md

internal/apps/admin/logs/routers.go

@@ -17,6 +17,7 @@ import (
 	"github.com/Rain-kl/Wavelet/internal/repository"
 	"github.com/Rain-kl/Wavelet/internal/repository/logstore"
 	"github.com/Rain-kl/Wavelet/pkg/logger"
+	"github.com/Rain-kl/Wavelet/pkg/util"
 	"github.com/gin-gonic/gin"
 
 	"github.com/Rain-kl/Wavelet/internal/shared/response"
@@ -105,7 +106,7 @@ func HandleLogWebSocket(c *gin.Context) {
 
 	// 在独立 goroutine 中读取客户端消息（保持连接活跃 + 检测断开）
 	done := make(chan struct{})
-	go func() {
+	util.Go(func() {
 		defer close(done)
 		for {
 			_, _, err := conn.ReadMessage()
@@ -113,7 +114,7 @@ func HandleLogWebSocket(c *gin.Context) {
 				return
 			}
 		}
-	}()
+	})
 
 	// 主循环：推送日志
 	for {

internal/apps/admin/message_gateway/errs.go

@@ -6,7 +6,7 @@ package message_gateway
 const (
 	errNameRequired          = "name is required"
 	errTypeInvalid           = "type must be telegram or qq"
-	errTelegramTokenRequired = "telegram bot secret is required" //nolint:gosec // user-facing validation text
+	errTelegramTokenRequired = "telegram bot secret is required"   //nolint:gosec // user-facing validation text
 	errQQCredentialsRequired = "qq app id and secret are required" //nolint:gosec // user-facing validation text
 	errChannelNotFound       = "channel not found"
 	errChannelProbeFailed    = "channel probe failed"

internal/apps/admin/push/events.go

@@ -16,6 +16,7 @@ import (
 	"github.com/Rain-kl/Wavelet/internal/repository"
 	"github.com/Rain-kl/Wavelet/pkg/logger"
 	pkgpush "github.com/Rain-kl/Wavelet/pkg/push"
+	"github.com/Rain-kl/Wavelet/pkg/util"
 	"gorm.io/gorm"
 )
 
@@ -76,7 +77,7 @@ var DefaultTrigger = &EventTrigger{}
 //nolint:contextcheck
 func (t *EventTrigger) Trigger(ctx context.Context, meta EventMetadata, body map[string]any) {
 	asyncCtx := context.WithoutCancel(ctx)
-	go func() {
+	util.Go(func() {
 		if body == nil {
 			body = make(map[string]any)
 		}
@@ -100,7 +101,7 @@ func (t *EventTrigger) Trigger(ctx context.Context, meta EventMetadata, body map
 		flatBody := getFlatBody(body)
 		msg, _ := t.buildMessage(&event, meta, flatBody, body)
 		t.enqueuePushTasks(asyncCtx, meta, &event, msg, flatBody)
-	}()
+	})
 }
 
 func (t *EventTrigger) buildMessage(event *model.PushEvent, meta EventMetadata, flatBody map[string]any, body map[string]any) (NotificationMessage, string) {

internal/apps/admin/updater/routers.go

@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/Rain-kl/Wavelet/pkg/logger"
+	"github.com/Rain-kl/Wavelet/pkg/util"
 	"github.com/gin-gonic/gin"
 
 	"github.com/Rain-kl/Wavelet/internal/shared/response"
@@ -58,11 +59,11 @@ func ApplyUpdate(c *gin.Context) {
 	logger.InfoF(c.Request.Context(), "[Updater] upgrade prepared; restarting with %s", stagedBinary)
 	c.JSON(http.StatusOK, response.OKNil())
 
-	go func() {
+	util.Go(func() {
 		time.Sleep(time.Second)
 		if err := replaceAndRestart(executable, stagedBinary); err != nil {
 			defaultManager.finishUpgrade()
 			logger.ErrorF(context.Background(), "[Updater] replace and restart failed: %v", err)
 		}
-	}()
+	})
 }