feat(core): sync framework security hardening and accessibility improvements

- add util.Go with panic recovery for background goroutines
- add util.EscapeLike and explicit ESCAPE clause for SQL LIKE queries
- add DummyCheckPassword and subtle.ConstantTimeCompare against timing attacks
- enforce session ID rotation upon login/oauth callback to prevent session fixation
- add sliding window login failure rate limiting and oauth state rate limiting
- fix redis client capture race in pubsub listeners and wait on stop channel
- adjust global --primary to oklch(51.1% 0.262 276.966) for WCAG AA contrast
- fix semantic heading levels and missing aria-labels across UI components
- document security, concurrency, and a11y standards in AGENTS.md

internal/apps/cap/manager.go

@@ -178,10 +178,13 @@ var (
 // GetDefaultManager yields the global singleton CAPTCHA manager.
 func GetDefaultManager() *Manager {
 	once.Do(func() {
-		secret := []byte("default-captcha-secret-key-at-least-16-bytes")
-		if config.Config != nil && config.Config.App.SessionSecret != "" {
+		var secret []byte
+		if config.Config != nil && strings.TrimSpace(config.Config.App.SessionSecret) != "" {
 			secret = []byte(config.Config.App.SessionSecret)
 		}
+		if len(secret) == 0 {
+			return
+		}
 
 		var store pkgcap.Store
 		if config.Config != nil && config.Config.Redis.Enabled && db.Redis != nil {

internal/apps/cap/middleware.go

@@ -16,6 +16,10 @@ func VerifyMiddleware(mgr *Manager, scope string) gin.HandlerFunc {
 			c.Next()
 			return
 		}
+		if mgr == nil {
+			response.AbortUnauthorized(c, errCapTokenInvalidOrExpired)
+			return
+		}
 
 		token := c.GetHeader("X-Cap-Token")
 		if token == "" {

internal/apps/cap/routers.go

@@ -44,6 +44,10 @@ func Challenge(c *gin.Context) {
 	}
 
 	mgr := GetDefaultManager()
+	if mgr == nil {
+		response.AbortInternal(c, "captcha is not configured")
+		return
+	}
 	resp, err := mgr.Generate(c.Request.Context(), req.Scope)
 	if err != nil {
 		logger.ErrorF(c.Request.Context(), "Generate cap challenge failed: %v", err)
@@ -77,6 +81,10 @@ func Redeem(c *gin.Context) {
 	}
 
 	mgr := GetDefaultManager()
+	if mgr == nil {
+		response.AbortInternal(c, "captcha is not configured")
+		return
+	}
 	resp, err := mgr.Redeem(c.Request.Context(), req.Token, req.Solutions, req.Scope)
 	if err != nil {
 		logger.ErrorF(c.Request.Context(), "Redeem cap solutions failed: %v", err)

internal/apps/cap/routers_test.go

@@ -9,10 +9,12 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"sync"
 	"testing"
 
 	"github.com/gin-gonic/gin"
 
+	"github.com/Rain-kl/Wavelet/internal/infra/config"
 	"github.com/Rain-kl/Wavelet/internal/model"
 	"github.com/Rain-kl/Wavelet/internal/repository"
 	"github.com/Rain-kl/Wavelet/internal/shared/response"
@@ -39,6 +41,16 @@ func TestCapEndpointsAndMiddleware(t *testing.T) {
 	sqliteDB, _, cleanup := testhelper.SetupTestEnvironment(t)
 	defer cleanup()
 
+	oldSecret := config.Config.App.SessionSecret
+	config.Config.App.SessionSecret = "test-captcha-session-secret"
+	once = sync.Once{}
+	defaultManager = nil
+	t.Cleanup(func() {
+		config.Config.App.SessionSecret = oldSecret
+		once = sync.Once{}
+		defaultManager = nil
+	})
+
 	r := testhelper.NewTestGinEngine()
 
 	// Mount CAPTCHA API endpoints

internal/apps/cap/runtime_settings.go

@@ -17,6 +17,7 @@ import (
 	"github.com/Rain-kl/Wavelet/internal/infra/persistence"
 	"github.com/Rain-kl/Wavelet/internal/model"
 	"github.com/Rain-kl/Wavelet/internal/repository"
+	"github.com/Rain-kl/Wavelet/pkg/util"
 )
 
 const (
@@ -190,7 +191,7 @@ func startRuntimeSettingsInvalidationListener() {
 		return
 	}
 
-	go func() {
+	util.Go(func() {
 		pubsub := db.Redis.Subscribe(context.Background(), repository.SystemConfigInvalidationChannel)
 		defer func() {
 			_ = pubsub.Close()
@@ -208,5 +209,5 @@ func startRuntimeSettingsInvalidationListener() {
 				InvalidateRuntimeSettings()
 			}
 		}
-	}()
+	})
 }